3.3

CVE-2022-23649: sigstore cosign Improper Certificate Validation

CVSS: 3.3v3.1LowModified
AliasesGHSA-ccxc-vr6p-4858BIT-cosign-2022-23649GO-2022-0326
Published 18-02-2022Last modified 23-04-2025
Open JSON

Vulnerability summary

CVE-2022-23649 is a low (CVSS 3.3) Improper Certificate Validation vulnerability in sigstore cosign. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.1% of scored vulnerabilities.

Overall risk
13/100
0100
Low · default modelHow is this calculated?
CVSS score
3.3/10
010
Low · v3.1 (CVE.org)
EPSS score
0.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 18-02-2022
    PublishedVulnerability first disclosed.
  2. 23-04-2025
    Last modifiedVulnerability information updated.

Description

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing" with Fulcio. If an attacker has access to the signature in OCI, they can manipulate cosign into believing the entry was stored in Rekor even though it wasn't. The vulnerability has been patched in v1.5.2 of Cosign. The `signature` in the `signedEntryTimestamp` provided by Rekor is now compared to the `signature` that is being verified. If these don't match, then an error is returned. If a valid bundle is copied to a different signature, verification should fail. Cosign output now only informs the user that certificates were verified if a certificate was in fact verified. There is currently no known workaround.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

5%

Versus all other CVEs

30-day change

0.00 pp

From 0.16% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Github.com/sigstore1 product
  • cosign< 1.5.2
Opensuse1 product
  • cosign&distro=openSUSE Tumbleweed< 1.5.2-1.1
Sigstore1 product

3 vendors · 3 products

References

6 links