Bug 2128820 (CVE-2022-36056)

Summary:	CVE-2022-36056 app-containers/cosign: false positive verification
Product:	[Other] Security Response	Reporter:	Sage McTaggart <amctagga>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jwon, lball, matzew, rhuss, rrajasek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cosign v 1.12.1	Doc Type:	---
Doc Text:	A vulnerability was found in cosign, where it incorrectly verified an artifact when the embedded rekorBundle does not reference the given signature. This flaw allows an attacker to exploit integrity and confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-09 17:32:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2127471

Description Sage McTaggart 2022-09-21 15:30:51 UTC

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful verification. And fourth an invalid transparency log entry will result in immediate success for verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues.

https://github.com/sigstore/cosign/commit/80b79ed8b4d28ccbce3d279fd273606b5cddcc25
https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388

Comment 3 errata-xmlrpc 2022-12-06 14:02:16 UTC

This issue has been addressed in the following products:

  RHACS-3.73-RHEL-8

Via RHSA-2022:8827 https://access.redhat.com/errata/RHSA-2022:8827

Comment 4 Product Security DevOps Team 2022-12-09 17:32:49 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-36056