Asraa

A number of issues have been found in cosign verify-blob, where cosign would successfully verify an artifact when verification should have failed. These issues include: - a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature, - when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked, - providing an invalid Rekor bundle without the experimental flag results in a successful verification, - an invalid transparency log entry will result in immediate success for verification.

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.71.1 Description: A remotely exploitable integer overflow issue exists due to a very large grpc-timeout value, leading to unexpected timeout calculations. Recommendations: For versions prior to 1.71.1, update to a version that contains a fix for this issue.

The issue is related to the parsing of request URLs that require host canonicalization.

The issue allows a remote attacker to craft a request that consumes CPU, resulting in a denial-of-service attack. This is due to the implementation having O(n^2) performance characteristics when verifying the total size of request headers. The attack can be performed by sending a request with many thousands of small headers, staying below the maximum request header size.