CVE-2022-36056 is a medium-severity (CVSS 5.5) CWE-347 vulnerability in github.com/sigstore/cosign. 1 public exploit reference exists, so weaponization risk is real. A fix is available for github.com/sigstore/cosign — see the affected versions and patch details below.
Vulnerabilities with blob verification in sigstore cosign
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2022-36056.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2022-36056 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 379,145 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
github.com/sigstore/cosignReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed.
Vulnerability 1: Bundle mismatch causes invalid verification.
Summary
A cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature.
Details
Cosign supports "bundles" which intend to allow offline verification of the signature and rekor inclusion. By using the --bundle flag in cosign sign-blob, cosign will create a JSON file called a "bundle". These bundles include three fields: base64Signature, cert, and rekorBundle. The desired behavior is that the verification of these bundles would:
- verify the provided blob using the included signature and certificate
- verify the rekorBundle SET
- verify the rekorBundle payload references the given artifact.
It appears that step three is not being performed, allowing "any old rekorBundle" to pass validation, even if the rekorBundle payload does not reference the provided blob or the certificate and signature in the rekorBundle do not match those at the top level.
Steps to reproduce
Enable keyless signing:
export COSIGN_EXPERIMENTAL=1
Create two random blobs:
dd bs=1 count=50 </dev/urandom >blob1
dd bs=1 count=50 </dev/urandom >blob2
Sign each blob:
cosign sign-blob blob1 --bundle bundle1
cosign sign-blob blob2 --bundle bundle2
Create a falsified bundle including the base64Signature and cert fields from bundle1 and the rekorBundle from bundle2:
jq --slurpfile bundle2 bundle2 '.rekorBundle = $bundle2[0].rekorBundle' bundle1 > invalidBundle
Now, the falsified bundle can be used to verify blob1:
$ cosign verify-blob blob1 --bundle invalidBundle
tlog entry verified offline
Verified OK
Patches
Users should update to the latest version of Cosign, 1.12.0.
Workaround
If you extract the signature and certificate from the bundle, you may use it for verification as follows and avoid using an invalid bundle:
$ cosign verify-blob blob1 --signature $(jq -r '.base64Signature' bundle1) --certificate $(jq -r '.cert' bundle1)
Note that this will make a network call to Rekor to fetch the Rekor entry. However, you may then be subject to Vulnerability 4.
Vulnerability 2: Certificate Identities are not checked in some cases
Summary
When providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked.
Details
Users who provide an offline Rekor bundle (--bundle) when verifying a blob using cosign verify-blob and include flags that check identity such as --certificate-email and --certificate-oidc-issuer are impacted. Additionally, users who provide the GitHub Actions verification flags such as --certificate-github-workflow-name when running cosign verify-blob without a bundle, key reference, or certificate are impacted.
When providing these flags, Cosign ignored their values. If a certificate's identity did not match the provided flags, Cosign would still successfully verify the blob.
Patches
Users should update to the latest version of Cosign, 1.12.0.
Workarounds
There are no workarounds, users should update.
Vulnerability 3: Invalid Rekor bundle without the experimental flag will result in successful verification
Summary
Providing an invalid Rekor bundle without the experimental flag results in a successful verification.
Details
Users who provide an offline Rekor bundle (--bundle) that was invalid (invalid signed entry timestamp, expired certificate, or malformed) when verifying a blob with cosign verify-blob and do not set the COSIGN_EXPERIMENTAL=1 flag are impacted.
When an invalid bundle was provided, Cosign would fallback to checking Rekor log inclusion by requesting proof of inclusion from the log. However, without the COSIGN_EXPERIMENTAL flag, Cosign would exit early and successfully verify the blob.
Patches
Users should update to the latest version of Cosign, 1.12.0.
Workarounds
There are no workarounds, users should update.
Vulnerability 4: Invalid transparency log entry will result in successful verification
Summary
An invalid transparency log entry will result in immediate success for verification.
Details
Users who provide a signature and certificate to verify-blob will fetch the associated Rekor entry for verification. If the returned entry was invalid (invalid signed entry timestamp, invalid inclusion proof, malformed entry with missing verification), then cosign exits early and succeeds unconditionally.
Patches
Users should update to the latest version of Cosign, 1.12.0.
Workarounds
There are no workarounds, users should update.
For more information
If you have any questions or comments about this advisory:
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/sigstore/cosign | all versions | 1.12.0go get github.com/sigstore/cosign@v1.12.0 |
Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/sigstore/cosign, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/sigstore/cosign to 1.12.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-36056 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2022-36056 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2022-36056. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
| Product | Fixed in | Advisory |
|---|---|---|
| RHACS-3.73-RHEL-8 | advanced-cluster-security/rhacs-main-rhel8:3.73.0-4 | RHSA-2022:8827 |
Frequently Asked Questions
Is CVE-2022-36056 in your dependencies?
O3 Security finds CVE-2022-36056 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.