SUSE-SU-2026:0777-1

SUSE-SU-2026:0777-1 · Security update for cosign

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for cosign fixes the following issues: Update to version 3.0.5 (jsc#SLE-23879). Security issues fixed: - CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620). - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253913). - CVE-2026-22703: Verification accepts any valid Rekor entry under certain conditions (bsc#1256496). - CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256562). - CVE-2026-23991: github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned by TUF repository (bsc#1257080). - CVE-2026-23992: github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a compromised or misconfigured TUF repository (bsc#1257085). - CVE-2026-24122: improper validation of certificates that outlive expired CA certificates (bsc#1258542). - CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257139). - CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258612). Other updates and bugfixes: * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679) * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670) * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680) * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702) * chore(deps): bump the actions group with 3 updates (#4703) * update golang builder to use go1.25.7 (#4687) * update golangci-lint to v2.8.x (#4688) * Support DSSE signing conformance test (#4685) * chore(deps): bump the actions group across 1 directory with 8 updates (#4689) * Deprecate rekor-entry-type flag (#4691) * Deprecate cosign triangulate (#4676) * Deprecate cosign copy (#4681) * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683) * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668) * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673) * Automatically require signed timestamp with Rekor v2 entries (#4666) * Fix syntax issue in conformance test, update nightly (#4664) * Add mTLS support for TSA client connections when signing with a signing config (#4620) * fix: avoid panic on malformed tlog entry body (#4652) * Verify validity of chain rather than just certificate (#4663) * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626) * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662) * Bump sigstore/sigstore to resolve GHSA (#4660) * Gracefully fail if bundle payload body is not a string (#4648) * fix: avoid panic on malformed replace payload (#4653) * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659) * fix: avoid panic on malformed attestation payload (#4651) * fix: avoid panic on malformed tlog entries (#4649) * Update conformance to latest * docs(cosign): clarify RFC3161 revocation semantics (#4642) * Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635) * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637) * Add origin key for ctfe trusted root * Add changelog updates for v3.0.4 and v2.6.2 (#4625) - Update to version 3.0.4: * Fix bundle verify path for old bundle/trusted root (#4623) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616) * chore(deps): bump cuelang.org/go in the gomod group (#4615) * Optimize cosign tree performance by caching digest resolution (#4612) * Don't require a trusted root to verify offline with a key (#4613) * Support default services for trusted-root and signing-config creation (#4592) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602) * chore(deps): bump github.com/sigstore/sigstore-go (#4578) * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601) * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611) * chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604) * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588) * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586) * chore(deps): bump the gomod group with 5 updates (#4599) * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600) * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584) * chore(deps): bump the actions group with 3 updates (#4587) * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589) * chore(deps): bump the gomod group with 9 updates (#4577) - Update to version 3.0.3: * 4554: Closes 4554 - Add warning when --output* is used (#4556) * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545) * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542) * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543) * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546) * chore(deps): bump the actions group with 4 updates (#4544) * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567) * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568) * update builder to use go1.25.5 (#4566) * Protobuf bundle support for subcommand `clean` (#4539) * Add staging flag to initialize with staging TUF metadata * update slack invite link (#4560) * Updating sign-blob to also support signing with a certificate (#4547) * Bump sigstore library dependencies (#4532) * Protobuf bundle support for subcommands `save` and `load` (#4538) * Fix cert attachment for new bundle with signing config * Fix OCI verification with local cert - old bundle * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519) * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535) * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536) * update go builder and cosign (#4529) * chore(deps): bump the gomod group across 1 directory with 7 updates (#4528) * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520) * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515) * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518) * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524) * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521) * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502) * chore(deps): bump the actions group across 1 directory with 2 updates (#4516) * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523) * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522) * Deprecate tlog-upload flag (#4458) * fix: Use signal context for `sign` cli package. * update offline verification directions (#4526) * Fix signing/verifying annotations for new bundle * Add support to download and attach for protobuf bundles (#4477) * Add --signing-algorithm flag (#3497) * Refactor signcommon bundle helpers * Add --bundle and fix --upload for new bundle * Pass insecure registry flags through to referrers * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483) * Add protobuf bundle support for tree subcommand (#4491) * Remove stale embed import (#4492) * Support multiple container identities * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484) * chore(deps): bump chainguard-dev/actions in the actions group (#4480) * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485) * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486) * chore(deps): b

Fix available

Published

2026-03-03T13:22:27Z

Updated

2026-03-04T22:17:29.473367Z

Stack: system

Check your server →