Denial Of Service (DOS)

2024-04-1509:02:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github.com/sigstore/cosign

denial of service

excessive memory allocation

untrusted artifacts

CVSS3

4.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H

AI Score

4.2

Confidence

High

EPSS

Percentile

15.5%

JSON

github.com/sigstore/cosign is vulnerable to a Denial of Service (DoS). The vulnerability is due to allocating excessive memory when creating slices based on the number of signatures, manifests, or attestations in untrusted artifacts. This flaw allows an attacker to trigger a Denial of Service via submitting a crafted artifact with an inflated number of signatures or manifests.