Alpine/cosign: low 3.3
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exist
Action: Upgrade cosign to 1.5.2-r0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.2-r0 | - |
Fixed versions
| 1.5.2-r0 |
Sources
published · modified · JSON