{"action":"Upgrade github.com/sigstore/cosign to 1.5.2 or later.","affected":[{"fixed":"1.5.2","introduced":"0"}],"component":"github.com/sigstore/cosign","cve_ids":["CVE-2022-23649"],"ecosystem":"Go","epss":0.00163,"exploited":false,"fixed_versions":["1.5.2"],"ghsa_id":"GHSA-ccxc-vr6p-4858","id":"tcs_01M5KFV5NB2K22N6QKKDRHPA87","modified_at":"2024-05-20T16:03:47Z","published_at":"2023-11-09T18:00:31Z","references":["https://osv.dev/vulnerability/GO-2022-0326","https://github.com/sigstore/cosign/commit/96d410a6580e4e81d24d112a0855c70ca3fb5b49","https://github.com/sigstore/cosign/releases/tag/v1.5.2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2022-0326","url":"https://osv.dev/vulnerability/GO-2022-0326"}],"summary":"Improper certificate validation in github.com/sigstore/cosign"}