GHSA-ccxc-vr6p-4858 · 深刻度： low · エコシステム： go — Improper Certificate Validation in Cosign
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing" with Fulcio. If an attacker has access to the signature in OCI, they can manipulate cosign into believing the entry was stored in Rekor even though it wasn't. The vulnerability has been patched in v1.5.2 of Cosign. The `signature` in the `signedEntryTimestamp` provided by Rekor is now compared to the `signature` that is being verified. If these don't match, then an error is returned. If a valid bundle is copied to a different signature, verification should fail. Cosign output now only informs the user that certificates were verified if a certificate was in fact verified. There is currently no known workaround.
総合評価: CVE-2022-23649 は低リスク（15.1/100）。CVSS 深刻度は低。悪用される可能性が高い（EPSS 0.16%、5 パーセンタイル） 推奨対応: 総合リスクは低く緊急対応は不要です。通常の保守サイクルでパッチを適用し、CVSS / EPSS が上昇したら優先度を見直してください。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.02% | 0.16% | +0.13% |
| 2 | 2026-05-26 | 0.05% | 0.02% | -0.03% |
| 3 | 2025-11-21 | — | 0.05% | — |
EPSS の全履歴 （全 7 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 3.3 | 3.1 | LOW |
|
1.8 | 1.4 | [email protected] |
| 3.3 | 3.1 | LOW |
|
1.8 | 1.4 | [email protected] |
| 2.1 | 2.0 | LOW |
|
3.9 | 2.9 | [email protected] |
GHSA-ccxc-vr6p-4858 · 深刻度： low · エコシステム： go — Improper Certificate Validation in Cosign
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
low | CVE-2022-23649: 1 source package rows (cosign); 7 state rows across 7 repos (3.17-community, 3.18-community, 3.19-community, 3.20-community, 3.21-community, 3.22-community, edge-community); fixed 7, open 0. | https://security.alpinelinux.org/vuln/CVE-2022-23649 |
debian
|
unimportant | CVE-2022-23649 unimportant priority: Debian including 1 source packages (cosign), 3 status rows across 3 suites (forky, sid, trixie): resolved 3. | https://security-tracker.debian.org/tracker/CVE-2022-23649 |
suse
|
medium | CVE-2022-23649 severity moderate: SUSE including 9 source package names (cosign, cosign-1.12.0-150400.3.6.1, …), 9 product×package rows across 6 product lines (SUSE Linux Enterprise Module for Basesystem 15 SP4, SUSE Linux Enterprise Module for Basesystem 15 SP5, … (6 product lines)): Fixed 8, Known Not Affected 1. | https://www.suse.com/security/cve/CVE-2022-23649/ |
| URL | タグ |
|---|---|
| https://github.com/sigstore/cosign/commit/96d410a6580e4e81d24d112a0855c70ca3fb5b49 | Patch Third Party Advisory |
| https://github.com/sigstore/cosign/security/advisories/GHSA-ccxc-vr6p-4858 | Third Party Advisory |