GHSA-vjxv-45g9-9296
cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/sigstore/cosign | < 1.10.1 | 1.10.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
`cosign verify-attestation` used with the `--type` flag will report a false positive verification when:
- There is at least one attestation with a valid signature
- There are NO attestations of the type being verified (--type defaults to "custom")
This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. Users should upgrade to cosign version 1.10.1 or greater for a patch. Currently the only workaround is to upgrade.
References
External links from the advisory. They lead to third-party sites.