Is CVE-2024-29903 actively exploited?

CVE-2024-29903 has no public evidence of in-the-wild exploitation as of 2025-01-09.

What is the CVSS score for CVE-2024-29903?

CVE-2024-29903 has a CVSS score of 4.2 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H.

How do I patch CVE-2024-29903?

Patch guidance is available from sigstore security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2024-29903.

CVE-2024-29903 - remediation guidance & executive summary

Description

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts. As such, the untrusted artifact can control the amount of memory that Cosign allocates. The exact issue is Cosign allocates excessive memory on the lines that creates a slice of the same length as the manifests. Version 2.2.4 contains a patch for the vulnerability.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
Attack Vector: network
Complexity: high
Privileges: high
User Action: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Weaknesses: CWE-770 CWE-770

Metadata

Primary Vendor: SIGSTORE
Published: 4/10/2024
Last Modified: 1/9/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

sigstore : cosign

Remediation Guidance

Executive Summary

Cite this page

CVE-2024-29903. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2024-29903

View on NIST NVD

CVE-2024-29903 vulnerability