Bug 2116258 (CVE-2022-35929) - CVE-2022-35929 cosign: `cosign verify-attestation --type` can report a false positive if any attestation exists
Summary: CVE-2022-35929 cosign: `cosign verify-attestation --type` can report a false ...
Keywords:
Status: NEW
Alias: CVE-2022-35929
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2116259
Blocks: 2115623
TreeView+ depends on / blocked
 
Reported: 2022-08-08 04:33 UTC by Avinash Hanwate
Modified: 2023-07-07 08:32 UTC (History)
10 users (show)

Fixed In Version: cosign 1.10.1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the cosign package. The cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and when there are no attestations of the type being verified (for example, —type defaults to "custom"). This issue can happen when signing with a standard keypair and keyless signing with Fulcio.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2022-08-08 04:33:30 UTC 
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.

https://github.com/sigstore/cosign/commit/c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94
https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296
Note You need to log in before you can comment on or make changes to this bug.