{"schemaVersion":3,"id":"CVE-2023-46737","aliases":["SUSE-SU-2023:4870-1","CGA-2qmx-wmgc-rjgc","CGA-2rc2-hjm3-6vfw","CGA-37xc-9gjq-w4ff","CGA-3g62-fh85-g62q","CGA-45g4-7phx-3pc2","CGA-4x8c-7fcc-7wp9","CGA-6mcj-4f6j-ph7p","CGA-7j3c-92x8-rf23","CGA-7mr7-c37j-pcqc","CGA-7wpw-v7x6-9r3c","CGA-7xx3-r422-v3xh","CGA-8q48-pc62-4m86","CGA-8vpq-v743-w29m","CGA-crrc-v2mr-cqq8","CGA-hmcr-365v-ccq5","CGA-mmxm-g67f-x8mc","CGA-p44j-7hvf-7r23","CGA-p76r-phrc-38q9","CGA-pvfc-8xp4-6jqm","CGA-px33-grx3-r9qw","CGA-qj54-8667-8qg7","CGA-qqwh-35pp-v9q4","CGA-vj39-vx77-xf3r","CGA-wgwx-gvgp-328g","CGA-wp26-77mv-q4p6","CGA-x2gr-pjcr-869q","GHSA-vfp6-jrw2-99g9","BIT-cosign-2023-46737","GO-2023-2181","openSUSE-SU-2024:13402-1","CGA-5v43-p96v-gfjr","CGA-qfj3-hrmv-9pc9","CGA-x4hf-mw43-9633","CGA-xx4m-33j8-vmh9"],"status":"published","duplicateOf":null,"title":null,"description":"Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is that Cosign loops through all attestations fetched from the remote registry in pkg/cosign.FetchAttestations. The attacker needs to compromise the registry or make a request to a registry they control. When doing so, the attacker must return a high number of attestations in the response to Cosign. The result will be that the attacker can cause Cosign to go into a long or infinite loop that will prevent other users from verifying their data. In Kyvernos case, an attacker whose privileges are limited to making requests to the cluster can make a request with an image reference to their own registry, trigger the infinite loop and deny other users from completing their admission requests. Alternatively, the attacker can obtain control of the registry used by an organization and return a high number of attestations instead the expected number of attestations. The issue can be mitigated rather simply by setting a limit to the limit of attestations that Cosign will loop through. The limit does not need to be high to be within the vast majority of use cases and still prevent the endless data attack. This issue has been patched in version 2.2.1 and users are advised to upgrade.","dates":{"published":"2023-11-07T17:30:25.717Z","modified":"2024-09-04T15:23:23.311Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.1,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":3.1,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","exploitability":4.1,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":3.1,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","exploitability":4.1,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":3.1,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","exploitability":4.1,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0064,"percentile":0.49739,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.0064},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0064,"percentile":0.49739}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0064,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0064,"percentile":0.49739}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_SIGSTORE_COSIGN","name":"Cosign","source":"github","url":"https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption","description":"The product does not properly control the allocation and maintenance of a limited resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/400.html"},{"id":"CWE-835","name":"Loop with Unreachable Exit Condition ('Infinite Loop')","description":"The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/835.html"}],"affected":[{"vendor":"chainguard","product":"aactl","name":"aactl","label":"aactl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/aactl","purlType":"apk","versions":[{"text":"< 0.4.12-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.12-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apko","name":"apko","label":"apko","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apko","purlType":"apk","versions":[{"text":"< 0.11.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.11.3-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cosign","name":"cosign","label":"cosign","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cosign","purlType":"apk","versions":[{"text":"< 2.2.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"falcoctl-fips","name":"falcoctl-fips","label":"falcoctl-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/falcoctl-fips","purlType":"apk","versions":[{"text":"< 0.6.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"flux-source-controller","name":"flux-source-controller","label":"flux-source-controller","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/flux-source-controller","purlType":"apk","versions":[{"text":"< 1.7.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.3-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ko","name":"ko","label":"ko","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ko","purlType":"apk","versions":[{"text":"< 0.15.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubescape","name":"kubescape","label":"kubescape","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubescape","purlType":"apk","versions":[{"text":"< 3.0.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.3-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"melange","name":"melange","label":"melange","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/melange","purlType":"apk","versions":[{"text":"< 0.5.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.5.3-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller","name":"policy-controller","label":"policy-controller","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller","purlType":"apk","versions":[{"text":"< 0.8.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"skaffold","name":"skaffold","label":"skaffold","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/skaffold","purlType":"apk","versions":[{"text":"< 2.10.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.10.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"slsa-verifier","name":"slsa-verifier","label":"slsa-verifier","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/slsa-verifier","purlType":"apk","versions":[{"text":"< 2.5.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spire-server","name":"spire-server","label":"spire-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spire-server","purlType":"apk","versions":[{"text":"< 1.8.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.8.4-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spire-server-fips","name":"spire-server-fips","label":"spire-server-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spire-server-fips","purlType":"apk","versions":[{"text":"< 1.8.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.8.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tekton-chains","name":"tekton-chains","label":"tekton-chains","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tekton-chains","purlType":"apk","versions":[{"text":"< 0.19.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tkn","name":"tkn","label":"tkn","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tkn","purlType":"apk","versions":[{"text":"< 0.33.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.33.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"aactl","name":"aactl","label":"aactl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/aactl","purlType":"apk","versions":[{"text":"< 0.4.12-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.12-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apko","name":"apko","label":"apko","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apko","purlType":"apk","versions":[{"text":"< 0.11.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.11.3-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"cosign","name":"cosign","label":"cosign","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/cosign","purlType":"apk","versions":[{"text":"< 2.2.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"flux-source-controller","name":"flux-source-controller","label":"flux-source-controller","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/flux-source-controller","purlType":"apk","versions":[{"text":"< 1.7.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.3-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ko","name":"ko","label":"ko","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ko","purlType":"apk","versions":[{"text":"< 0.15.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubescape","name":"kubescape","label":"kubescape","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubescape","purlType":"apk","versions":[{"text":"< 3.0.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.3-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"melange","name":"melange","label":"melange","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/melange","purlType":"apk","versions":[{"text":"< 0.5.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.5.3-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"policy-controller","name":"policy-controller","label":"policy-controller","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/policy-controller","purlType":"apk","versions":[{"text":"< 0.8.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.3-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"skaffold","name":"skaffold","label":"skaffold","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/skaffold","purlType":"apk","versions":[{"text":"< 2.10.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.10.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"slsa-verifier","name":"slsa-verifier","label":"slsa-verifier","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/slsa-verifier","purlType":"apk","versions":[{"text":"< 2.5.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"spire-server","name":"spire-server","label":"spire-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/spire-server","purlType":"apk","versions":[{"text":"< 1.8.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.8.4-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tekton-chains","name":"tekton-chains","label":"tekton-chains","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tekton-chains","purlType":"apk","versions":[{"text":"< 0.19.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tkn","name":"tkn","label":"tkn","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tkn","purlType":"apk","versions":[{"text":"< 0.33.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.33.0-r2","eol":null,"hubHref":null},{"vendor":"github.com/sigstore","product":"cosign","name":"github.com/sigstore/cosign","label":"cosign","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/sigstore/cosign","purlType":"golang","versions":[{"text":"< 1.13.2","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 1.13.2 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/sigstore/cosign","product":"v2","name":"github.com/sigstore/cosign/v2","label":"v2","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/sigstore/cosign/v2","purlType":"golang","versions":[{"text":"< 2.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"cosign&distro=openSUSE Leap 15.4","name":"cosign","label":"cosign&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/cosign&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 2.2.1-150400.3.14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.1-150400.3.14.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"cosign&distro=openSUSE Leap 15.5","name":"cosign","label":"cosign&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/cosign&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 2.2.1-150400.3.14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.1-150400.3.14.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"cosign&distro=openSUSE Tumbleweed","name":"cosign","label":"cosign&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/cosign&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 2.2.1-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.1-1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cosign&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","name":"cosign","label":"cosign&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cosign&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","purlType":"rpm","versions":[{"text":"< 2.2.1-150400.3.14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.1-150400.3.14.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cosign&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5","name":"cosign","label":"cosign&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cosign&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5","purlType":"rpm","versions":[{"text":"< 2.2.1-150400.3.14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.1-150400.3.14.1","eol":null,"hubHref":null},{"vendor":"sigstore","product":"cosign","name":"cosign","label":"cosign","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.1","eol":null,"hubHref":"/vendor/sigstore/cosign"}],"affectedCount":36,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9","label":"github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f","label":"github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234870-1/","label":"www.suse.com/support/update/announcement/2023/suse-su-20234870-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1216933","label":"bugzilla.suse.com/1216933","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46737","label":"www.suse.com/security/cve/CVE-2023-46737","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46737.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46737.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46737","label":"nvd.nist.gov/vuln/detail/CVE-2023-46737","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/sigstore/cosign/pull/3364","label":"github.com/sigstore/cosign/pull/3364","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/sigstore/cosign","label":"github.com/sigstore/cosign","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/sigstore/cosign/releases/tag/v1.13.2","label":"github.com/sigstore/cosign/releases/tag/v1.13.2","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/sigstore/cosign/releases/tag/v2.2.1","label":"github.com/sigstore/cosign/releases/tag/v2.2.1","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-2CX5-CJQJ-RFMX","CGA-37GF-J859-6FRP","CGA-3QX5-C88R-3829","CGA-5J78-48FP-QFR4","CGA-746R-4Q69-QQ97","CGA-78HQ-28G5-JQMH","CGA-9C38-3MR9-8P8P","CGA-9MCR-H39P-H5G2","CGA-CVJ3-47XV-4Q3R","CGA-F4XQ-PPV3-28PJ","CGA-HMH4-G97Q-RFVV","CGA-JW56-V3WG-772V","CGA-M963-XMH8-2PC8","CGA-MP8F-5Q7X-GCGH","CGA-MRGW-49X9-44G8","CGA-R4WM-XF76-M5GH","CGA-VQ76-JV6H-3F48","CGA-VQ7W-8266-MFW9"]},"timeline":[{"kind":"published","date":"2023-11-07T17:30:25.717Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-04T15:23:23.311Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T21:00:42.726Z","stale":false,"partial":false}}