{"action":"Upgrade github.com/sigstore/cosign to 1.13.2 or later.","affected":[{"fixed":"1.13.2","introduced":"0"}],"component":"github.com/sigstore/cosign","cve_ids":["CVE-2023-46737"],"ecosystem":"Go","epss":0.0064,"exploited":false,"fixed_versions":["1.13.2"],"ghsa_id":"GHSA-vfp6-jrw2-99g9","id":"tcs_01M5KFP1R6KDH570X15F6NVPCT","modified_at":"2026-09-10T03:50:04.292430481Z","published_at":"2023-11-08T15:02:51Z","references":["https://osv.dev/vulnerability/GHSA-vfp6-jrw2-99g9","https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9","https://nvd.nist.gov/vuln/detail/CVE-2023-46737","https://github.com/sigstore/cosign/pull/3364","https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f","https://github.com/sigstore/cosign","https://github.com/sigstore/cosign/releases/tag/v1.13.2","https://github.com/sigstore/cosign/releases/tag/v2.2.1"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"GHSA-vfp6-jrw2-99g9","url":"https://osv.dev/vulnerability/GHSA-vfp6-jrw2-99g9"}],"summary":"Cosign vulnerable to possible endless data attack from attacker-controlled registry"}