Security update for cosign
This update for cosign rebuilds it against the current go security release.
- Mettez à jour vers 3.1.3-150400.3.59.1
Publication Mise à jour
PatchFirst · Vulnérabilités récentes
Vulnérabilités de cosign
Vulnérabilités publiées pour cosign au cours des 30 derniers jours : 2. Présentes dans le catalogue KEV : 0.
Vulnérabilités : 11
Security update for cosign
This update for cosign fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117). - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278614). - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025). - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215). - Verification bypass via public key in legacy bundle (bsc#1282542). Changes for cosign: - update to 3.1.3: * Auto-det
- Mettez à jour vers 3.1.3-150400.3.57.1
Publication Mise à jourSecurity update for cosign
This update for cosign rebuilds it against the current go security release.
- Mettez à jour vers 3.1.2-150400.3.54.1
Publication Mise à jourSecurity update for cosign
This update for cosign rebuilds it against the current go security release.
- Mettez à jour vers 3.1.2-150400.3.52.1
Publication Mise à jourSecurity update for cosign
This update for cosign rebuilds it against the current go security release.
- Mettez à jour vers 3.1.1-150400.3.47.1
Publication Mise à jourSecurity update for cosign
This update for cosign fixes the following issues - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: multiple issues when parsing HTML files (bsc#1267044). - CVE-2026-33815: memory-safety vulnerability (bsc#1261811). - CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: Fixed multiple issues in golang.org/x/crypto/ssh (bsc#1266049).
- Mettez à jour vers 3.1.1-150400.3.45.1
Publication Mise à jourSecurity update for cosign
This update for cosign fixes the following issue - CVE-2026-39395: Incorrect attestation verification due to malformed payloads or mismatched predicate types (bsc#1261859). Changes for cosign: - update to 3.0.6: * Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801) * Handle whitespace-only certificate annotation (#4760) * fix(sign): closing SignerVerifier too early when signing with a security key (#4761) * Disallow --new-bundle-format and --rfc3161-timestamp (#4762) * support managed keys in conformance testing (#4728) * Add support for GCE metadata server env var (#4732) * fix: preserve per-layer annotations in WriteAttesta
- Mettez à jour vers 3.0.6-150400.3.42.1
Publication Mise à jourSecurity update for cosign
This update for cosign rebuilds it against the current go 1.25 security release.
- Mettez à jour vers 3.0.5-150400.3.39.1
Publication Mise à jourSecurity update for cosign
This update for cosign rebuilds it against the current go 1.25 security release.
- Mettez à jour vers 3.0.5-150400.3.37.1
Publication Mise à jourSecurity update for cosign
This update for cosign fixes the following issues: Update to version 3.0.5 (jsc#SLE-23879). Security issues fixed: - CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620). - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253913). - CVE-2026-22703: Verification accepts any valid Rekor entry under certain conditions (bsc#1256496). - CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256562). - CVE-2026-23991: github.com/theupdatefra
- Mettez à jour vers 3.0.5-150400.3.35.1
Publication Mise à jourSecurity update for cosign
This update for cosign fixes the following issues: Update to version 2.5.3 (jsc#SLE-23879): - CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego (bsc#1246725) Changelog: Update to 2.5.3: - Add signing-config create command (#4280) - Allow multiple services to be specified for trusted-root create (#4285) - force when copying the latest image to overwrite (#4298) - Fix cert verification logic for trusted-root/SCTs (#4294) - Fix lint error for types package (#4295) - feat: Add OCI 1.1+ experimental support to tree (#4205) - Add validity period end for trusted-root create (#4271) - avoid double-loading trustedroot from fil
- Mettez à jour vers 2.5.3-150400.3.30.1
Publication Mise à jour
Vérifiez votre serveur
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.