CVE-2022-35929 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-35929 Interim 1 7 2023-09-08T23:27:19Z current 2022-08-05T23:34:05Z 2023-09-08T23:27:19Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-35929 cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2022-August/011974.html E-Mail link for SUSE-SU-2022:2877-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Server 15 SP4-TERADATA SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP4 openSUSE Leap 15.4 openSUSE Tumbleweed cosign-1.10.1-1.1 cosign-1.10.1-150400.3.3.1 cosign-1.10.1-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 cosign-1.10.1-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 cosign-1.10.1-150400.3.3.1 as a component of SUSE Linux Enterprise Server 15 SP4-TERADATA cosign-1.10.1-150400.3.3.1 as a component of openSUSE Leap 15.4 cosign-1.10.1-1.1 as a component of openSUSE Tumbleweed cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2022-35929 SUSE Linux Enterprise Module for Basesystem 15 SP4:cosign-1.10.1-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP5:cosign-1.10.1-150400.3.3.1 SUSE Linux Enterprise Server 15 SP4-TERADATA:cosign-1.10.1-150400.3.3.1 openSUSE Leap 15.4:cosign-1.10.1-150400.3.3.1 openSUSE Tumbleweed:cosign-1.10.1-1.1 moderate 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N