CVE catalog
CVE-2022-35929
cosign-1.10.1-1.1 on GA media
- Severity
- Critical · CVSS 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.68% · Oct 25, 2026
This update for cosign fixes the following issues: - Updated to 1.10.1 (jsc#SLE-23879): - CVE-2022-35929: Fixed an issue where cosign verify-attestation --type could report false positives when there was at least one attestation with a valid signature and there were no attestations of the type being verified (bsc#1202157).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Suse | cosign | linux enterprise module for basesystem 15 sp4 | 1.10.1-150400.3.3.1 | fixed |
| Opensuse | cosign | leap 15.4 | 1.10.1-150400.3.3.1 | fixed |
| Opensuse | cosign | tumbleweed | 1.10.1-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Suse | cosign | rpm | linux enterprise module for basesystem 15 sp4 | 1.10.1-150400.3.3.1 | Not reported | SUSE-SU-2022:2877-1 | Not reported |
| Opensuse | cosign | rpm | leap 15.4 | 1.10.1-150400.3.3.1 | Not reported | SUSE-SU-2022:2877-1 | Not reported |
| Opensuse | cosign | rpm | tumbleweed | 1.10.1-1.1 | Not reported | OPENSUSE-SU-2024:12240-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [cosign-bash-completion]Unknown
Source package: [cosign]
Details (1)
3.1.2-1.2· noarch · tumbleweedUnknown · Fixed:
1.10.1-1.1Version impact unknown
pypi · cosign · opensuse · tumbleweed
- [cosign-fish-completion]Unknown
Source package: [cosign]
Details (1)
3.1.2-1.2· noarch · tumbleweedUnknown · Fixed:
1.10.1-1.1Version impact unknown
pypi · cosign · opensuse · tumbleweed
- [cosign-zsh-completion]Unknown
Source package: [cosign]
Details (1)
3.1.2-1.2· noarch · tumbleweedUnknown · Fixed:
1.10.1-1.1Version impact unknown
pypi · cosign · opensuse · tumbleweed
- [cosign]Fixed
Source package: [cosign]
Details (1)
3.1.2-1.2· x86_64 · tumbleweedFixed · Fixed:
1.10.1-1.1pypi · cosign · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_2877-1.json]
- [https://osv.dev/vulnerability/SUSE-SU-2022:2877-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12240-1]
- [https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-35929.json]
[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]