Bug 1222837 (CVE-2024-29903)

Summary:	VUL-0: CVE-2024-29903: cosign: Malicious artifects can cause machine-wide denial of service
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Marcus Meissner <meissner>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	abergmann, thomas.leroy
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/401415/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-29903:4.2:(AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-04-15 12:37:11 UTC

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts. As such, the untrusted artifact can control the amount of memory that Cosign allocates. The exact issue is Cosign allocates excessive memory on the lines that creates a slice of the same length as the manifests. Version 2.2.4 contains a patch for the vulnerability.

References:
https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e
https://github.com/sigstore/cosign/releases/tag/v2.2.4
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-29903
https://www.cve.org/CVERecord?id=CVE-2024-29903
https://github.com/sigstore/cosign/blob/14795db16417579fac0c00c11e166868d7976b61/pkg/cosign/verify.go#L948-L955
https://github.com/sigstore/cosign/blob/286a98a4a99c1b2f32f84b0d560e324100312280/pkg/oci/remote/signatures.go#L56-L70
https://github.com/sigstore/cosign/security/advisories/GHSA-95pr-fxf5-86gv
https://bugzilla.redhat.com/show_bug.cgi?id=2274504

Comment 1 Thomas Leroy 2024-04-15 12:37:27 UTC

Affected:
- SUSE:SLE-15-SP4:Update
- openSUSE:Factory

Comment 2 OBSbugzilla Bot 2024-04-15 13:35:03 UTC

This is an autogenerated message for OBS integration:
This bug (1222837) was mentioned in
https://build.opensuse.org/request/show/1167811 Factory / cosign

Comment 4 Maintenance Automation 2024-05-02 08:30:03 UTC

SUSE-SU-2024:1486-1: An update that solves two vulnerabilities and contains one feature can now be installed.

Category: security (moderate)
Bug References: 1222835, 1222837
CVE References: CVE-2024-29902, CVE-2024-29903
Jira References: SLE-23879
Maintenance Incident: [SUSE:Maintenance:33590](https://smelt.suse.de/incident/33590/)
Sources used:
openSUSE Leap 15.4 (src):
 cosign-2.2.4-150400.3.20.1
openSUSE Leap 15.5 (src):
 cosign-2.2.4-150400.3.20.1
Basesystem Module 15-SP5 (src):
 cosign-2.2.4-150400.3.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 5 Alexander Bergmann 2024-06-05 13:38:00 UTC

Fixed and released.

Comment 6 Maintenance Automation 2024-06-18 12:30:38 UTC

SUSE-SU-2024:1486-2: An update that solves two vulnerabilities and contains one feature can now be installed.

Category: security (moderate)
Bug References: 1222835, 1222837
CVE References: CVE-2024-29902, CVE-2024-29903
Jira References: SLE-23879
Maintenance Incident: [SUSE:Maintenance:33590](https://smelt.suse.de/incident/33590/)
Sources used:
openSUSE Leap 15.6 (src):
 cosign-2.2.4-150400.3.20.1
Basesystem Module 15-SP6 (src):
 cosign-2.2.4-150400.3.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.