{"schemaVersion":3,"id":"CVE-2024-29902","aliases":["CGA-2f25-wrc6-cfm3","CGA-2jcq-755r-73jj","CGA-2qx4-fvr9-78wq","CGA-3pxr-8pwc-vhr7","CGA-4m2x-c258-2hqp","CGA-4wvx-qpw4-xv28","CGA-4xhw-vxgf-fq43","CGA-5m2m-mmjh-pqgw","CGA-5v6h-j87g-j3w7","CGA-5vq6-4cqv-pv6c","CGA-5wg8-qrf6-6jvv","CGA-64r8-9x3r-4qjm","CGA-7c9w-wh9r-4vpp","CGA-7vvq-w78w-7gfp","CGA-86p6-7p43-h7f2","CGA-884x-pjwj-4573","CGA-9872-fwc7-qmc5","CGA-9g39-348w-qr2h","CGA-c5r8-hmw8-69h7","CGA-c8rc-3r38-rc2c","CGA-cchm-g878-77xr","CGA-cqrj-mjxv-54cx","CGA-f79q-wf5m-c57j","CGA-fgj2-vhqf-4fmf","CGA-fhqm-2g6g-9c48","CGA-frjc-m4rg-2jrp","CGA-frmq-69h5-g74c","CGA-g4qp-qmm8-cpjj","CGA-ggj5-9rj9-h8vf","CGA-gpm2-57w8-9g4x","CGA-j8mx-wmq6-g5pr","CGA-m2x3-6xm5-fmgf","CGA-mp2w-2mx8-3ggm","CGA-pqq3-w4cw-h58v","CGA-q78g-3vwp-84cr","CGA-qw75-f8vw-qgr8","CGA-qxjj-vmmm-hjp7","CGA-rqgg-cqgr-rv9r","CGA-rxq8-mjx9-524g","CGA-vr83-jq8h-v9gc","CGA-xmcx-59mq-qx68","CGA-xxhf-6pfx-qxf4","GHSA-88jx-383q-w4qc","BIT-cosign-2024-29902","GO-2024-2718","CGA-44v5-8fvh-26fr","CGA-4hh2-2gjr-675p","CGA-4rj4-mrw5-vphh","CGA-4wg8-jwjx-33hf","CGA-5499-3qvf-f4jg","CGA-6m32-5f45-q3x8","CGA-74pw-8g93-4c2p","CGA-c94c-wgfc-gv69","CGA-cchv-44j7-5xr4","CGA-f354-v8px-8r5m","CGA-hxch-v8v5-rr6q","CGA-hxq9-g9p5-pjj6","CGA-p9wr-6497-vfjj","CGA-rjx8-v7xf-6fqm","CGA-rwqf-553w-8xxx","CGA-w564-5p3j-8gvq","CGA-x593-89p5-phvj","CGA-xp6m-vh9g-8v8q"],"status":"published","duplicateOf":null,"title":null,"description":"Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial. The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the attachments size is larger than the machine has memory available, the machine will be denied of service. The Go runtime will make a SigKill after a few seconds of system-wide denial. This issue can allow a supply-chain escalation from a compromised registry to the Cosign user: If an attacher has compromised a registry or the account of an image vendor, they can include a malicious attachment and hurt the image consumer. Version 2.2.4 contains a patch for the vulnerability.","dates":{"published":"2024-04-10T22:28:19.788Z","modified":"2024-08-02T01:17:58.609Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.9,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.2,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":4.2,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","exploitability":1.3,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":4.2,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","exploitability":1.3,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":4.2,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","exploitability":1.3,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00658,"percentile":0.50565,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00658},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00658,"percentile":0.50565}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00658,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00658,"percentile":0.50565}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"chainguard","product":"aactl","name":"aactl","label":"aactl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/aactl","purlType":"apk","versions":[{"text":"< 0.4.12-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.12-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apko","name":"apko","label":"apko","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apko","purlType":"apk","versions":[{"text":"< 0.14.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.14.0-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"chainctl","name":"chainctl","label":"chainctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/chainctl","purlType":"apk","versions":[{"text":"< 0.2.59-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.59-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"docker-credential-cgr","name":"docker-credential-cgr","label":"docker-credential-cgr","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/docker-credential-cgr","purlType":"apk","versions":[{"text":"< 0.2.59-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.59-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"falcoctl","name":"falcoctl","label":"falcoctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/falcoctl","purlType":"apk","versions":[{"text":"< 0.7.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.3-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"falcoctl-fips","name":"falcoctl-fips","label":"falcoctl-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/falcoctl-fips","purlType":"apk","versions":[{"text":"< 0.7.3-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.3-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"flux-source-controller","name":"flux-source-controller","label":"flux-source-controller","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/flux-source-controller","purlType":"apk","versions":[{"text":"< 1.2.5-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.5-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitsign","name":"gitsign","label":"gitsign","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitsign","purlType":"apk","versions":[{"text":"< 0.10.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"goreleaser","name":"goreleaser","label":"goreleaser","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/goreleaser","purlType":"apk","versions":[{"text":"< 1.26.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.26.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ko","name":"ko","label":"ko","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ko","purlType":"apk","versions":[{"text":"< 0.15.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ko-fips","name":"ko-fips","label":"ko-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ko-fips","purlType":"apk","versions":[{"text":"< 0.15.2-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.2-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubescape","name":"kubescape","label":"kubescape","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubescape","purlType":"apk","versions":[{"text":"< 3.0.8-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.8-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"melange","name":"melange","label":"melange","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/melange","purlType":"apk","versions":[{"text":"< 0.6.11-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.11-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"neuvector-sigstore-interface","name":"neuvector-sigstore-interface","label":"neuvector-sigstore-interface","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/neuvector-sigstore-interface","purlType":"apk","versions":[{"text":"< 0_git20240520-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0_git20240520-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller","name":"policy-controller","label":"policy-controller","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller-fips","name":"policy-controller-fips","label":"policy-controller-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller-fips","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller-tester","name":"policy-controller-tester","label":"policy-controller-tester","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller-tester","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller-tester-fips","name":"policy-controller-tester-fips","label":"policy-controller-tester-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller-tester-fips","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"skaffold","name":"skaffold","label":"skaffold","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/skaffold","purlType":"apk","versions":[{"text":"< 2.11.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"slsa-verifier","name":"slsa-verifier","label":"slsa-verifier","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/slsa-verifier","purlType":"apk","versions":[{"text":"< 2.5.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spire-server","name":"spire-server","label":"spire-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spire-server","purlType":"apk","versions":[{"text":"< 1.9.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.4-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spire-server-fips","name":"spire-server-fips","label":"spire-server-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spire-server-fips","purlType":"apk","versions":[{"text":"< 1.9.4-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.4-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tekton-chains","name":"tekton-chains","label":"tekton-chains","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tekton-chains","purlType":"apk","versions":[{"text":"< 0.20.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tekton-chains-fips","name":"tekton-chains-fips","label":"tekton-chains-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tekton-chains-fips","purlType":"apk","versions":[{"text":"< 0.20.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tkn","name":"tkn","label":"tkn","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tkn","purlType":"apk","versions":[{"text":"< 0.36.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.36.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tkn-fips","name":"tkn-fips","label":"tkn-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tkn-fips","purlType":"apk","versions":[{"text":"< 0.36.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.36.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vexctl","name":"vexctl","label":"vexctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vexctl","purlType":"apk","versions":[{"text":"< 0.2.6-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.6-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wolfictl","name":"wolfictl","label":"wolfictl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wolfictl","purlType":"apk","versions":[{"text":"< 0.15.18-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.18-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zarf","name":"zarf","label":"zarf","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zarf","purlType":"apk","versions":[{"text":"< 0.33.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.33.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zot","name":"zot","label":"zot","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zot","purlType":"apk","versions":[{"text":"< 2.0.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.3-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"aactl","name":"aactl","label":"aactl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/aactl","purlType":"apk","versions":[{"text":"< 0.4.12-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.12-r10","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apko","name":"apko","label":"apko","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apko","purlType":"apk","versions":[{"text":"< 0.14.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.14.0-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"falcoctl","name":"falcoctl","label":"falcoctl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/falcoctl","purlType":"apk","versions":[{"text":"< 0.7.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.3-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"flux-source-controller","name":"flux-source-controller","label":"flux-source-controller","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/flux-source-controller","purlType":"apk","versions":[{"text":"< 1.2.5-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.5-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"gitsign","name":"gitsign","label":"gitsign","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/gitsign","purlType":"apk","versions":[{"text":"< 0.10.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.1-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"goreleaser","name":"goreleaser","label":"goreleaser","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/goreleaser","purlType":"apk","versions":[{"text":"< 1.26.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.26.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ko","name":"ko","label":"ko","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ko","purlType":"apk","versions":[{"text":"< 0.15.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.2-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubescape","name":"kubescape","label":"kubescape","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubescape","purlType":"apk","versions":[{"text":"< 3.0.8-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.8-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"melange","name":"melange","label":"melange","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/melange","purlType":"apk","versions":[{"text":"< 0.6.11-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.11-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"neuvector-sigstore-interface","name":"neuvector-sigstore-interface","label":"neuvector-sigstore-interface","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/neuvector-sigstore-interface","purlType":"apk","versions":[{"text":"< 0_git20240520-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0_git20240520-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"policy-controller","name":"policy-controller","label":"policy-controller","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/policy-controller","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"policy-controller-tester","name":"policy-controller-tester","label":"policy-controller-tester","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/policy-controller-tester","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"skaffold","name":"skaffold","label":"skaffold","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/skaffold","purlType":"apk","versions":[{"text":"< 2.11.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"slsa-verifier","name":"slsa-verifier","label":"slsa-verifier","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/slsa-verifier","purlType":"apk","versions":[{"text":"< 2.5.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"spire-server","name":"spire-server","label":"spire-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/spire-server","purlType":"apk","versions":[{"text":"< 1.9.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.4-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tekton-chains","name":"tekton-chains","label":"tekton-chains","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tekton-chains","purlType":"apk","versions":[{"text":"< 0.20.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tkn","name":"tkn","label":"tkn","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tkn","purlType":"apk","versions":[{"text":"< 0.36.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.36.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vexctl","name":"vexctl","label":"vexctl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vexctl","purlType":"apk","versions":[{"text":"< 0.2.6-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.6-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"wolfictl","name":"wolfictl","label":"wolfictl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/wolfictl","purlType":"apk","versions":[{"text":"< 0.15.18-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.18-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"zarf","name":"zarf","label":"zarf","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/zarf","purlType":"apk","versions":[{"text":"< 0.33.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.33.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"zot","name":"zot","label":"zot","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/zot","purlType":"apk","versions":[{"text":"< 2.0.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.3-r3","eol":null,"hubHref":null},{"vendor":"github.com/sigstore","product":"cosign","name":"github.com/sigstore/cosign","label":"cosign","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/sigstore/cosign","purlType":"golang","versions":[{"text":"≤ 2.2.3","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"≤ 2.2.3 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/sigstore/cosign","product":"v2","name":"github.com/sigstore/cosign/v2","label":"v2","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/sigstore/cosign/v2","purlType":"golang","versions":[{"text":"< 2.2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.4","eol":null,"hubHref":null},{"vendor":"sigstore","product":"cosign","name":"cosign","label":"cosign","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.4","eol":null,"hubHref":"/vendor/sigstore/cosign"}],"affectedCount":54,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/sigstore/cosign/security/advisories/GHSA-88jx-383q-w4qc","label":"github.com/sigstore/cosign/security/advisories/GHSA-88jx-383q-w4qc","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Vendor Advisory"]},{"url":"https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e","label":"github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40","label":"github.com/google/…","hostname":"github.com","tags":["X Refsource MISC","WEB","Product"]},{"url":"https://github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239","label":"github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go","hostname":"github.com","tags":["X Refsource MISC","WEB","Product"]},{"url":"https://github.com/sigstore/cosign/releases/tag/v2.2.4","label":"github.com/sigstore/cosign/releases/tag/v2.2.4","hostname":"github.com","tags":["X Refsource MISC","WEB","Release Notes"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29902.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29902.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29902","label":"nvd.nist.gov/vuln/detail/CVE-2024-29902","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/sigstore/cosign","label":"github.com/sigstore/cosign","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2024:13863-1","OPENSUSE-SU-2024:13903-1","RHEA-2024:4022","SUSE-SU-2024:1486-1","SUSE-SU-2024:1486-2"],"duplicates":[],"related":["CGA-26MM-G94G-PXC2","CGA-28X2-5QRH-HH3R","CGA-3VP2-4C22-6X4H","CGA-4J44-5C2H-QX58","CGA-4VMH-7QP5-JX93","CGA-5V2P-JC6W-XRC4","CGA-766X-V8VG-WR8F","CGA-8XF3-2FH6-XG7C","CGA-988W-5GXC-F4HP","CGA-9CCG-FRPG-8H34","CGA-C923-Q88J-G65F","CGA-CF6J-5MJW-R283","CGA-FR9X-MFM9-9RPJ","CGA-GCCF-JXC8-2RCH","CGA-GP75-VGR2-HQ3Q","CGA-H2QV-4H26-3MWW","CGA-J372-GCFV-2369","CGA-J8P9-8HFH-9FQ4","CGA-JW8H-3M69-GM88","CGA-M8VC-XMRR-957V","CGA-MPGP-3V9M-5HF4","CGA-MPXG-JFRM-QC7P","CGA-P27G-5R49-56M8","CGA-Q2JQ-5MP7-74J7","CGA-Q2W3-2R29-VWC7","CGA-Q88R-W26M-HMVF","CGA-Q9FM-PXP4-J86G","CGA-R83H-JC8C-3H53","CGA-R9Q7-6WHQ-M842","CGA-W8J8-5HP8-PQ2F","OPENSUSE-SU-2024:13863-1","OPENSUSE-SU-2024:13903-1","SUSE-SU-2024:1486-1","SUSE-SU-2024:1486-2"]},"timeline":[{"kind":"published","date":"2024-04-10T22:28:19.788Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-02T01:17:58.609Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":24,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T12:10:38.011Z","stale":false,"partial":false}}