GO-2024-2718
- Source
- https://pkg.go.dev/vuln/GO-2024-2718
- Import Source
- https://vuln.go.dev/ID/GO-2024-2718.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GO-2024-2718
- Aliases
- Published
- 2024-06-05T15:10:52Z
- Modified
- 2024-09-11T06:13:24.665578Z
- Summary
- Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign
- Details
-
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign
- Database specific
{ "review_status": "UNREVIEWED", "url": "https://pkg.go.dev/vuln/GO-2024-2718" }- References
-
- https://github.com/sigstore/cosign/security/advisories/GHSA-88jx-383q-w4qc
- https://nvd.nist.gov/vuln/detail/CVE-2024-29902
- https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e
- https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40
- https://github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239
- https://github.com/sigstore/cosign/releases/tag/v2.2.4
Affected packages
Go / github.com/sigstore/cosign
Package
- Name
- github.com/sigstore/cosign
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/sigstore/cosign
Go / github.com/sigstore/cosign/v2
Package
- Name
- github.com/sigstore/cosign/v2
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/sigstore/cosign/v2