{"action":"Upgrade github.com/sigstore/cosign to 1.5.2 or later.","affected":[{"fixed":"1.5.2","introduced":"0"}],"component":"github.com/sigstore/cosign","cve_ids":["CVE-2022-23649"],"ecosystem":"Go","epss":0.00163,"exploited":false,"fixed_versions":["1.5.2"],"ghsa_id":"GHSA-ccxc-vr6p-4858","id":"tcs_01M5KF75W07GTZQFK0JN5AEYJP","modified_at":"2023-12-06T01:02:02.154344Z","published_at":"2022-02-22T19:34:09Z","references":["https://osv.dev/vulnerability/GHSA-ccxc-vr6p-4858","https://github.com/sigstore/cosign/security/advisories/GHSA-ccxc-vr6p-4858","https://nvd.nist.gov/vuln/detail/CVE-2022-23649","https://github.com/sigstore/cosign/commit/96d410a6580e4e81d24d112a0855c70ca3fb5b49","https://github.com/sigstore/cosign","https://github.com/sigstore/cosign/releases/tag/v1.5.2"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"GHSA-ccxc-vr6p-4858","url":"https://osv.dev/vulnerability/GHSA-ccxc-vr6p-4858"}],"summary":"Improper Certificate Validation in Cosign"}