github.com/sigstore/cosign v1.13.6

Why

• warnVulnerability

  Denial of service attack from remote registry in github.com/sigstore/cosign

• warnVulnerability

  Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

• warnVulnerability

  Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

• warnVulnerability

  Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign

• warnVulnerability

  Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign

• warnVulnerability

  Cosign malicious attachments can cause system-wide denial of service

• warnVulnerability

  Cosign malicious artifacts can cause machine-wide DoS

• warnVulnerability

  Cosign's verify-blob-attestation reports false positive when payload parsing fails (fixed in 2.6.3)

What the code does

On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.