{"schemaVersion":3,"id":"CVE-2024-29903","aliases":["CGA-2447-jcr7-prxr","CGA-2jcg-9c5m-h62j","CGA-32ww-92gc-vf62","CGA-38mc-ww5g-rjxx","CGA-3pr5-m838-v3v9","CGA-3rvg-h985-rvpq","CGA-3vvg-xhmg-v2q8","CGA-5jvm-7pjj-7r55","CGA-5rgg-fg62-8r2p","CGA-5xcv-2qfv-fcwp","CGA-6235-95hw-rm2g","CGA-736w-wfvg-86rj","CGA-886h-2fjv-gppx","CGA-89m4-5764-3mjj","CGA-8cxw-qvmx-f552","CGA-8m2w-c25v-cgw9","CGA-9fv4-pjq5-cvg5","CGA-9m3w-q3rw-9pp7","CGA-cg42-66hg-3c49","CGA-cp49-6x5x-6jxj","CGA-cp8j-h697-2p2c","CGA-fgf9-gvmf-84q2","CGA-gg2x-mw42-4hh8","CGA-ggcc-4gfx-67x4","CGA-ghh2-2vvx-j6jh","CGA-h6j2-qxgg-pj94","CGA-j95x-gjg5-qphf","CGA-jh58-m5r8-5v5r","CGA-jh8x-xp26-jjpg","CGA-jp5h-cj96-v9v8","CGA-m3rp-44w3-48jq","CGA-m42p-fg2r-2hgg","CGA-p4hw-hr6v-2x77","CGA-pq8j-wfvq-m7hp","CGA-q3j7-5fg3-ch6c","CGA-qg2p-gr84-37hw","CGA-qjqj-8vxw-63m8","CGA-r3vw-689j-h67f","CGA-rg55-7q4q-q9fj","CGA-rh2h-6vp9-x43c","CGA-rvx2-9v2g-h6f7","CGA-wpj6-2wjj-mqcr","GHSA-95pr-fxf5-86gv","BIT-cosign-2024-29903","GO-2024-2719","CGA-2pr7-pw5w-x4px","CGA-2q6v-37wf-jf8w","CGA-48m7-j5c7-3fv6","CGA-4gvw-q9hq-3cwv","CGA-5jjc-qf77-v2pq","CGA-6qqj-p9jr-x56q","CGA-79c4-8cwp-vwwg","CGA-8235-w9gw-v5x6","CGA-825q-c368-7fpm","CGA-c4v6-67hm-wfp4","CGA-c8v9-w86x-rh3m","CGA-fc2p-m75w-j92c","CGA-m9mv-8q56-68xr","CGA-p7j6-v4f4-hpgg","CGA-rmjq-8676-6wjf","CGA-w42h-3xvh-vrwj","CGA-w743-wv87-fwmr","CGA-xxcr-8v5j-mmjv"],"status":"published","duplicateOf":null,"title":null,"description":"Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts. As such, the untrusted artifact can control the amount of memory that Cosign allocates. The exact issue is Cosign allocates excessive memory on the lines that creates a slice of the same length as the manifests. Version 2.2.4 contains a patch for the vulnerability.","dates":{"published":"2024-04-10T22:30:50.890Z","modified":"2024-08-02T01:17:58.600Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.2,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":4.2,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","exploitability":1.3,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":4.2,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","exploitability":1.3,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":4.2,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","exploitability":1.3,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00851,"percentile":0.57543,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00851},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00851,"percentile":0.57543}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00851,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00851,"percentile":0.57543}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_SIGSTORE_COSIGN","name":"Cosign","source":"github","url":"https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"chainguard","product":"aactl","name":"aactl","label":"aactl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/aactl","purlType":"apk","versions":[{"text":"< 0.4.12-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.12-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apko","name":"apko","label":"apko","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apko","purlType":"apk","versions":[{"text":"< 0.14.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.14.0-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"chainctl","name":"chainctl","label":"chainctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/chainctl","purlType":"apk","versions":[{"text":"< 0.2.59-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.59-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"docker-credential-cgr","name":"docker-credential-cgr","label":"docker-credential-cgr","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/docker-credential-cgr","purlType":"apk","versions":[{"text":"< 0.2.59-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.59-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"falcoctl","name":"falcoctl","label":"falcoctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/falcoctl","purlType":"apk","versions":[{"text":"< 0.7.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.3-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"falcoctl-fips","name":"falcoctl-fips","label":"falcoctl-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/falcoctl-fips","purlType":"apk","versions":[{"text":"< 0.7.3-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.3-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"flux-source-controller","name":"flux-source-controller","label":"flux-source-controller","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/flux-source-controller","purlType":"apk","versions":[{"text":"< 1.2.5-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.5-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitsign","name":"gitsign","label":"gitsign","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitsign","purlType":"apk","versions":[{"text":"< 0.10.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"goreleaser","name":"goreleaser","label":"goreleaser","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/goreleaser","purlType":"apk","versions":[{"text":"< 1.26.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.26.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ko","name":"ko","label":"ko","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ko","purlType":"apk","versions":[{"text":"< 0.15.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ko-fips","name":"ko-fips","label":"ko-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ko-fips","purlType":"apk","versions":[{"text":"< 0.15.2-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.2-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubescape","name":"kubescape","label":"kubescape","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubescape","purlType":"apk","versions":[{"text":"< 3.0.8-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.8-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"melange","name":"melange","label":"melange","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/melange","purlType":"apk","versions":[{"text":"< 0.6.11-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.11-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"neuvector-sigstore-interface","name":"neuvector-sigstore-interface","label":"neuvector-sigstore-interface","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/neuvector-sigstore-interface","purlType":"apk","versions":[{"text":"< 0_git20240520-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0_git20240520-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller","name":"policy-controller","label":"policy-controller","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller-fips","name":"policy-controller-fips","label":"policy-controller-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller-fips","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller-tester","name":"policy-controller-tester","label":"policy-controller-tester","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller-tester","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller-tester-fips","name":"policy-controller-tester-fips","label":"policy-controller-tester-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller-tester-fips","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"skaffold","name":"skaffold","label":"skaffold","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/skaffold","purlType":"apk","versions":[{"text":"< 2.11.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"slsa-verifier","name":"slsa-verifier","label":"slsa-verifier","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/slsa-verifier","purlType":"apk","versions":[{"text":"< 2.5.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spire-server","name":"spire-server","label":"spire-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spire-server","purlType":"apk","versions":[{"text":"< 1.9.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.4-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spire-server-fips","name":"spire-server-fips","label":"spire-server-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spire-server-fips","purlType":"apk","versions":[{"text":"< 1.9.4-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.4-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tekton-chains","name":"tekton-chains","label":"tekton-chains","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tekton-chains","purlType":"apk","versions":[{"text":"< 0.20.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tekton-chains-fips","name":"tekton-chains-fips","label":"tekton-chains-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tekton-chains-fips","purlType":"apk","versions":[{"text":"< 0.20.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tkn","name":"tkn","label":"tkn","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tkn","purlType":"apk","versions":[{"text":"< 0.36.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.36.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tkn-fips","name":"tkn-fips","label":"tkn-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tkn-fips","purlType":"apk","versions":[{"text":"< 0.36.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.36.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vexctl","name":"vexctl","label":"vexctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vexctl","purlType":"apk","versions":[{"text":"< 0.2.6-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.6-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wolfictl","name":"wolfictl","label":"wolfictl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wolfictl","purlType":"apk","versions":[{"text":"< 0.15.18-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.18-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zarf","name":"zarf","label":"zarf","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zarf","purlType":"apk","versions":[{"text":"< 0.33.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.33.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zot","name":"zot","label":"zot","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zot","purlType":"apk","versions":[{"text":"< 2.0.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.3-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"aactl","name":"aactl","label":"aactl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/aactl","purlType":"apk","versions":[{"text":"< 0.4.12-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.12-r10","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apko","name":"apko","label":"apko","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apko","purlType":"apk","versions":[{"text":"< 0.14.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.14.0-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"falcoctl","name":"falcoctl","label":"falcoctl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/falcoctl","purlType":"apk","versions":[{"text":"< 0.7.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.3-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"flux-source-controller","name":"flux-source-controller","label":"flux-source-controller","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/flux-source-controller","purlType":"apk","versions":[{"text":"< 1.2.5-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.5-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"gitsign","name":"gitsign","label":"gitsign","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/gitsign","purlType":"apk","versions":[{"text":"< 0.10.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.1-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"goreleaser","name":"goreleaser","label":"goreleaser","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/goreleaser","purlType":"apk","versions":[{"text":"< 1.26.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.26.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ko","name":"ko","label":"ko","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ko","purlType":"apk","versions":[{"text":"< 0.15.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.2-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubescape","name":"kubescape","label":"kubescape","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubescape","purlType":"apk","versions":[{"text":"< 3.0.8-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.8-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"melange","name":"melange","label":"melange","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/melange","purlType":"apk","versions":[{"text":"< 0.6.11-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.11-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"neuvector-sigstore-interface","name":"neuvector-sigstore-interface","label":"neuvector-sigstore-interface","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/neuvector-sigstore-interface","purlType":"apk","versions":[{"text":"< 0_git20240520-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0_git20240520-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"policy-controller","name":"policy-controller","label":"policy-controller","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/policy-controller","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"policy-controller-tester","name":"policy-controller-tester","label":"policy-controller-tester","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/policy-controller-tester","purlType":"apk","versions":[{"text":"< 0.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"skaffold","name":"skaffold","label":"skaffold","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/skaffold","purlType":"apk","versions":[{"text":"< 2.11.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"slsa-verifier","name":"slsa-verifier","label":"slsa-verifier","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/slsa-verifier","purlType":"apk","versions":[{"text":"< 2.5.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"spire-server","name":"spire-server","label":"spire-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/spire-server","purlType":"apk","versions":[{"text":"< 1.9.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.4-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tekton-chains","name":"tekton-chains","label":"tekton-chains","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tekton-chains","purlType":"apk","versions":[{"text":"< 0.20.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tkn","name":"tkn","label":"tkn","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tkn","purlType":"apk","versions":[{"text":"< 0.36.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.36.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vexctl","name":"vexctl","label":"vexctl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vexctl","purlType":"apk","versions":[{"text":"< 0.2.6-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.6-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"wolfictl","name":"wolfictl","label":"wolfictl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/wolfictl","purlType":"apk","versions":[{"text":"< 0.15.18-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.15.18-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"zarf","name":"zarf","label":"zarf","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/zarf","purlType":"apk","versions":[{"text":"< 0.33.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.33.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"zot","name":"zot","label":"zot","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/zot","purlType":"apk","versions":[{"text":"< 2.0.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.3-r3","eol":null,"hubHref":null},{"vendor":"github.com/sigstore","product":"cosign","name":"github.com/sigstore/cosign","label":"cosign","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/sigstore/cosign","purlType":"golang","versions":[{"text":"≤ 2.2.3","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"≤ 2.2.3 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/sigstore/cosign","product":"v2","name":"github.com/sigstore/cosign/v2","label":"v2","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/sigstore/cosign/v2","purlType":"golang","versions":[{"text":"< 2.2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.4","eol":null,"hubHref":null},{"vendor":"sigstore","product":"cosign","name":"cosign","label":"cosign","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.4","eol":null,"hubHref":"/vendor/sigstore/cosign"}],"affectedCount":54,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/sigstore/cosign/security/advisories/GHSA-95pr-fxf5-86gv","label":"github.com/sigstore/cosign/security/advisories/GHSA-95pr-fxf5-86gv","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e","label":"github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/sigstore/cosign/blob/14795db16417579fac0c00c11e166868d7976b61/pkg/cosign/verify.go#L948-L955","label":"github.com/sigstore/cosign/blob/14795db16417579fac0c00c11e166868d7976b61/pkg/cosign/verify.go","hostname":"github.com","tags":["X Refsource MISC","WEB","Product"]},{"url":"https://github.com/sigstore/cosign/blob/286a98a4a99c1b2f32f84b0d560e324100312280/pkg/oci/remote/signatures.go#L56-L70","label":"github.com/sigstore/…","hostname":"github.com","tags":["X Refsource MISC","WEB","Product"]},{"url":"https://github.com/sigstore/cosign/releases/tag/v2.2.4","label":"github.com/sigstore/cosign/releases/tag/v2.2.4","hostname":"github.com","tags":["X Refsource MISC","WEB","Release Notes"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29903.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29903.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29903","label":"nvd.nist.gov/vuln/detail/CVE-2024-29903","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/sigstore/cosign","label":"github.com/sigstore/cosign","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2024:13863-1","RHEA-2024:4022","SUSE-SU-2024:1486-1","SUSE-SU-2024:1486-2"],"duplicates":[],"related":["CGA-24JM-9GPV-M3HV","CGA-25H7-2R26-HW4V","CGA-25QW-CJPF-8QV3","CGA-4M7G-XQVJ-RHRW","CGA-5383-WJHQ-X4R5","CGA-5GV3-G5MR-JQP3","CGA-5GVM-JVC3-7HXQ","CGA-8V6J-CWPF-H9C3","CGA-9965-4F9J-67RF","CGA-C23H-V4GM-GQW3","CGA-C396-HJJ8-346R","CGA-C784-5M8C-X972","CGA-GP53-C4XJ-6XX4","CGA-GR5P-P2FG-423G","CGA-H7HC-HPG4-FCX8","CGA-HP7F-287Q-8WG2","CGA-HXCQ-J497-QCX5","CGA-JW9X-FQ37-2HR2","CGA-M2CR-QXF3-CP73","CGA-M36H-5F52-F972","CGA-MXXJ-FM99-GXQR","CGA-P6VM-Q7J6-FFCR","CGA-P8HW-FXHX-VVQJ","CGA-P94C-XVRP-9XPH","CGA-P9C4-2PMJ-PH33","CGA-PPQ7-9W5P-F4GC","CGA-PPVF-J352-F3GG","CGA-QFP8-4QVM-3R3J","CGA-VFXC-P74J-9J86","CGA-X8V2-57Q3-G96V","OPENSUSE-SU-2024:13863-1","SUSE-SU-2024:1486-1","SUSE-SU-2024:1486-2"]},"timeline":[{"kind":"published","date":"2024-04-10T22:30:50.890Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-02T01:17:58.600Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T18:45:37.801Z","stale":false,"partial":false}}