CVE-2022-35929: 
NixOS vulnerability analysis and mitigation

CVE-2022-35929 affects cosign, a container signing and verification utility, in versions prior to 1.10.1. The vulnerability was discovered and disclosed in July 2022. The issue involves the cosign verify-attestation command with the --type flag reporting false positive verifications under specific conditions (GitHub Advisory).

The vulnerability occurs when using the cosign verify-attestation command with the --type flag. The command reports a false positive verification when there is at least one attestation with a valid signature but NO attestations of the type being verified (where --type defaults to "custom"). This can happen in both standard keypair signing and "keyless" signing with Fulcio (GitHub Advisory).

The vulnerability can lead to false positive verification results, potentially causing security misconfigurations or incorrect trust assumptions in container verification workflows. This is particularly concerning in automated pipelines where verification results are used to make security decisions (GitHub Advisory).

The vulnerability has been patched in version 1.10.1 of cosign. Users are advised to upgrade to this version or later as there are no known workarounds for this issue (GitHub Advisory).