CVE-2022-35929

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
sigstore	cosign	< 1.10.1

References

https://github.com/sigstore/cosign/commit/c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94Exploit, Patch, Third Party Advisory
https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296Exploit, Third Party Advisory
https://github.com/sigstore/cosign/commit/c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94Exploit, Patch, Third Party Advisory
https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296Exploit, Third Party Advisory

Timeline

Published: Aug 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-359308.8PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will r CVE-2022-359312.7Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, CVE-2022-359325.3Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected convers CVE-2022-359336.1This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could s CVE-2022-359347.5TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of s CVE-2022-359357.5TensorFlow is an open source platform for machine learning. The implementation of SobolSampleOp is vulnerable to a denial of service via CHE CVE-2022-359365.3Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes CVE-2022-359379.1TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and o CVE-2022-359389.1TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and o CVE-2022-359399.8TensorFlow is an open source platform for machine learning. The `ScatterNd` function takes an input argument that determines the indices of CVE-2022-35945.3A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback CVE-2022-359407.5TensorFlow is an open source platform for machine learning. The `RaggedRangOp` function takes an argument `limits` that is eventually used t