CVE-2026-39395: sigstore cosign

csirt@kutim:~/threat-intel/cve/CVE-2026-39395

CVSS 5.3 · Medium EPSS 0,29%

Kerentanan Improper Check for Unusual or Exceptional Conditions pada sigstore cosign. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.

Rincian

Terbit di NVD: 7 April 2026
Terakhir diubah: 24 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-754: Improper Check for Unusual or Exceptional Conditions
EPSS (30 hari): 0,29% peluang dieksploitasi; lebih tinggi dari 20,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sigstore	cosign	Semua versi sebelum 2.6.3
sigstore	cosign	Versi 3.0.0 hingga sebelum 3.0.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6 mitigasi · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.