CVE Feed

    Dashboard / CVE / CVE-2022-35929

    CVE-2022-35929

    cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.

    Published:Aug 4, 2022
    Last Modified:Apr 22, 2025
    EPS:Aug 4, 2022
    EPSS Score:0.00202
    CVSS Score:7.1

    Affected Products

    Vendor
    Sigstore
    Product
    Cosign

    Exploits

    https://github.com/sigstore/cosign/commit/c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296https://github.com/sigstore/cosign/commit/c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-463 Padding Oracle Crypto Attack
    CAPEC-475 Signature Spoofing by Improper Validation

    Related CVEs

    CVE-2026-39395 (CVSS 4.3) — Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign ve…
    CVE-2026-24122 (CVSS 3.7) — Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an iss…
    CVE-2026-22703 (CVSS 5.5) — Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, …
    CVE-2024-29902 (CVSS 4.2) — Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote im…
    CVE-2024-29903 (CVSS 4.2) — Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously…
    CVE-2023-46737 (CVSS 3.1) — Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attac…
    CVE-2022-36056 (CVSS 5.5) — Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In…
    CVE-2022-23649 (CVSS 3.3) — Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prio…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High