Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 8 articles for you...
202
security advisorysecurity issueimportantopenSUSE 15.4 cosign Important Security Update SUSE-SU-2026-1486-1
An update that can now be installed.. # Security update for cosign Announcement ID: SUSE-SU-2026:1486-1 Release Date: 2026-04-20T15:51:24Z Rating: important References: Affected Products: * Basesystem Module 15-SP7 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that can now be installed. ## Description: This update for cosign rebuilds it against the current go 1.25 security release. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1486=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1486=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1486=1 * SUSE Linux EnterpriseServer 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1486=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1486=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1486=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1486=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1486=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1486=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-1486=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-1486=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1486=1 ## Package List: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-150400.3.39.1 * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server for SAP Applications15 SP6 (ppc64le x86_64) * cosign-debuginfo-3.0.5-150400.3.39.1 * cosign-3.0.5-150400.3.39.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * cosign-debuginfo-3.0.5-150400.3.39.1 * cosign-3.0.5-150400.3.39.1 * openSUSE Leap 15.4 (noarch) * cosign-bash-completion-3.0.5-150400.3.39.1 * cosign-zsh-completion-3.0.5-150400.3.39.1 * cosign-fish-completion-3.0.5-150400.3.39.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-150400.3.39.1 * cosign-3.0.5-150400.3.39.1 * Basesystem Module 15-SP7 (noarch) * cosign-bash-completion-3.0.5-150400.3.39.1 * cosign-zsh-completion-3.0.5-150400.3.39.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * cosign-3.0.5-150400.3.39.1 . Important security update for cosign in openSUSE with key patch installation instructions for various systems.. security update, cosign, important update, openSUSE patch. . Severity: Important. LinuxSecurity.com Team
Apr 20, 2026
•Important
OpenSUSE
100
security advisorysecurity issueSuSESUSE Linux Enterprise cosign Important Update 2026-1486-1
# Security update for cosign Announcement ID: SUSE-SU-2026:1486-1 Release Date: 2026-04-20T15:51:24Z Rating: important References:. # Security update for cosign Announcement ID: SUSE-SU-2026:1486-1 Release Date: 2026-04-20T15:51:24Z Rating: important References: Affected Products: * Basesystem Module 15-SP7 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that can now be installed. ## Description: This update for cosign rebuilds it against the current go 1.25 security release. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1486=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1486=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1486=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1486=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1486=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1486=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1486=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1486=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1486=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-1486=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-1486=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1486=1 ## Package List: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-150400.3.39.1 * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64lex86_64) * cosign-3.0.5-150400.3.39.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * cosign-debuginfo-3.0.5-150400.3.39.1 * cosign-3.0.5-150400.3.39.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * cosign-debuginfo-3.0.5-150400.3.39.1 * cosign-3.0.5-150400.3.39.1 * openSUSE Leap 15.4 (noarch) * cosign-bash-completion-3.0.5-150400.3.39.1 * cosign-zsh-completion-3.0.5-150400.3.39.1 * cosign-fish-completion-3.0.5-150400.3.39.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-150400.3.39.1 * cosign-3.0.5-150400.3.39.1 * Basesystem Module 15-SP7 (noarch) * cosign-bash-completion-3.0.5-150400.3.39.1 * cosign-zsh-completion-3.0.5-150400.3.39.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * cosign-3.0.5-150400.3.39.1 . Update for cosign available; addresses security concerns on multiple SUSE distributions. Install promptly via recommended methods.. cosign security SUSE update Linux patch. . Severity: Important. LinuxSecurity.com Team
Apr 20, 2026
•Important
SuSE
100
security advisorymoderatedenial of serviceSUSE Linux Enterprise Server 16.1 Upgrade Essential Data Security Patch
An update that solves nine vulnerabilities can now be installed.. # Security update for cosign Announcement ID: SUSE-SU-2026:20904-1 Release Date: 2026-03-18T11:29:30Z Rating: moderate References: * bsc#1250620 * bsc#1253913 * bsc#1256496 * bsc#1256562 * bsc#1257080 * bsc#1257085 * bsc#1257139 * bsc#1258542 * bsc#1258612 Cross-References: * CVE-2025-11065 * CVE-2025-58181 * CVE-2026-22703 * CVE-2026-22772 * CVE-2026-23991 * CVE-2026-23992 * CVE-2026-24122 * CVE-2026-24137 * CVE-2026-26958 CVSS scores: * CVE-2025-11065 ( SUSE ): 5.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2025-11065 ( SUSE ): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N * CVE-2025-11065 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2025-58181 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-58181 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-58181 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-22703 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-22703 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-22703 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-22772 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N * CVE-2026-22772 ( SUSE ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N * CVE-2026-22772 ( NVD ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N * CVE-2026-22772 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-23991 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-23991 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-23991 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-23991 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-23992 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-23992 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-23992 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-23992 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-24122 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24122 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24122 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24137 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-24137 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-24137 ( NVD ): 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N * CVE-2026-26958 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2026-26958 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2026-26958 ( NVD ): 1.7 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * SUSE Linux Enterprise Server - BCI 16.0 An update that solves nine vulnerabilities can now be installed. ## Description: This update for cosign fixes the following issues: Update to version 3.0.5: * CVE-2026-24122: Fixed improper validation of certificates that outlive expired CA certificates (bsc#1258542) * CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258612) * CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257139) * CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitraryinternal services (bsc#1256562) * CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned by TUF repository (bsc#1257080) * CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a compromised or misconfigured TUF repository (bsc#1257085) * CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620) * CVE-2026-22703: Fixed that cosign verification accepts any valid Rekor entry under certain conditions (bsc#1256496) * CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253913) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server - BCI 16.0 zypper in -t patch SUSE-SLES-16.0-404=1 ## Package List: * SUSE Linux Enterprise Server - BCI 16.0 (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-160000.1.1 * cosign-3.0.5-160000.1.1 ## References: * https://www.suse.com/security/cve/CVE-2025-11065.html * https://www.suse.com/security/cve/CVE-2025-58181.html * https://www.suse.com/security/cve/CVE-2026-22703.html * https://www.suse.com/security/cve/CVE-2026-22772.html * https://www.suse.com/security/cve/CVE-2026-23991.html * https://www.suse.com/security/cve/CVE-2026-23992.html * https://www.suse.com/security/cve/CVE-2026-24122.html * https://www.suse.com/security/cve/CVE-2026-24137.html * https://www.suse.com/security/cve/CVE-2026-26958.html * https://bugzilla.suse.com/show_bug.cgi?id=1250620 * https://bugzilla.suse.com/show_bug.cgi?id=1253913 * https://bugzilla.suse.com/show_bug.cgi?id=1256496 * https://bugzilla.suse.com/show_bug.cgi?id=1256562 * https://bugzilla.suse.com/show_bug.cgi?id=1257080 * https://bugzilla.suse.com/show_bug.cgi?id=1257085 * https://bugzilla.suse.com/show_bug.cgi?id=1257139 * https://bugzilla.suse.com/show_bug.cgi?id=1258542 * https://bugzilla.suse.com/show_bug.cgi?id=1258612 . This update addresses nine vulnerabilities in Cosign with moderate severity, enhancing system security for SUSE servers.. cosign update, SUSE vulnerabilities, moderate severity Cosign. . LinuxSecurity.com Team
Apr 01, 2026
SuSE
202
security advisoryupdateimportantFedora 37 38 safeguard Vital Security Patch 2026-2099-2
An update that can now be installed.. # Security update for cosign Announcement ID: SUSE-SU-2026:1098-1 Release Date: 2026-03-26T21:24:08Z Rating: important References: Affected Products: * Basesystem Module 15-SP7 * openSUSE Leap 15.4 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that can now be installed. ## Description: This update for cosign rebuilds it against the current go 1.25 security release. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-1098=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-1098=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-1098=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1098=1 * SUSE Linux EnterpriseHigh Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1098=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1098=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1098=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1098=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1098=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1098=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1098=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1098=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1098=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * cosign-debuginfo-3.0.5-150400.3.37.1 * cosign-3.0.5-150400.3.37.1 * openSUSE Leap 15.4 (noarch) * cosign-bash-completion-3.0.5-150400.3.37.1 * cosign-zsh-completion-3.0.5-150400.3.37.1 * cosign-fish-completion-3.0.5-150400.3.37.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-150400.3.37.1 * cosign-3.0.5-150400.3.37.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-150400.3.37.1 * cosign-3.0.5-150400.3.37.1 * Basesystem Module 15-SP7 (noarch) * cosign-bash-completion-3.0.5-150400.3.37.1 * cosign-zsh-completion-3.0.5-150400.3.37.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4(aarch64 x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-150400.3.37.1 * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * cosign-debuginfo-3.0.5-150400.3.37.1 * cosign-3.0.5-150400.3.37.1 . Important security update for cosign in openSUSE affects multiple products. Critical fixes for system security and integrity.. openSUSE security patch, cosign update, important security release. . Severity: Important. LinuxSecurity.com Team
Mar 27, 2026
•Important
OpenSUSE
100
security advisorysecurity updateSuSESUSE Linux Enterprise Server Important Cosign Update SUSE-SU-2026-1098-1
# Security update for cosign Announcement ID: SUSE-SU-2026:1098-1 Release Date: 2026-03-26T21:24:08Z Rating: important References:. # Security update for cosign Announcement ID: SUSE-SU-2026:1098-1 Release Date: 2026-03-26T21:24:08Z Rating: important References: Affected Products: * Basesystem Module 15-SP7 * openSUSE Leap 15.4 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that can now be installed. ## Description: This update for cosign rebuilds it against the current go 1.25 security release. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-1098=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-1098=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-1098=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1098=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1098=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1098=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1098=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1098=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1098=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1098=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1098=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1098=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1098=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * cosign-debuginfo-3.0.5-150400.3.37.1 * cosign-3.0.5-150400.3.37.1 * openSUSE Leap 15.4 (noarch) * cosign-bash-completion-3.0.5-150400.3.37.1 * cosign-zsh-completion-3.0.5-150400.3.37.1 * cosign-fish-completion-3.0.5-150400.3.37.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-150400.3.37.1 * cosign-3.0.5-150400.3.37.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-150400.3.37.1 * cosign-3.0.5-150400.3.37.1 * Basesystem Module 15-SP7 (noarch) * cosign-bash-completion-3.0.5-150400.3.37.1 * cosign-zsh-completion-3.0.5-150400.3.37.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) *cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * cosign-debuginfo-3.0.5-150400.3.37.1 * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * cosign-3.0.5-150400.3.37.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * cosign-debuginfo-3.0.5-150400.3.37.1 * cosign-3.0.5-150400.3.37.1 . Explore the important security update for Cosign in SUSE. Ensure your system is compliant with the latest security measures.. SUSE Cosign Update, Important Security Advisory, Linux Security Patch. . Severity: Important. LinuxSecurity.com Team
Mar 27, 2026
•Important
SuSE
202
security advisorymoderatedenial of serviceopenSUSE cosign Moderate Update 2026-0777-1 Denial of Service Issues
An update that solves nine vulnerabilities and contains one feature can now be installed.. # Security update for cosign Announcement ID: SUSE-SU-2026:0777-1 Release Date: 2026-03-03T13:22:36Z Rating: moderate References: * bsc#1250620 * bsc#1253913 * bsc#1256496 * bsc#1256562 * bsc#1257080 * bsc#1257085 * bsc#1257139 * bsc#1258542 * bsc#1258612 * jsc#SLE-23879 Cross-References: * CVE-2025-11065 * CVE-2025-58181 * CVE-2026-22703 * CVE-2026-22772 * CVE-2026-23991 * CVE-2026-23992 * CVE-2026-24122 * CVE-2026-24137 * CVE-2026-26958 CVSS scores: * CVE-2025-11065 ( SUSE ): 5.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2025-11065 ( SUSE ): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N * CVE-2025-11065 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2025-58181 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-58181 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-58181 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-22703 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-22703 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-22703 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-22772 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N * CVE-2026-22772 ( SUSE ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N * CVE-2026-22772 ( NVD ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N * CVE-2026-23991 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-23991 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-23991 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-23991 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-23992 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-23992 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-23992 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-23992 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-24122 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24122 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24122 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24137 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-24137 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-24137 ( NVD ): 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N * CVE-2026-26958 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2026-26958 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2026-26958 ( NVD ): 1.7 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * Basesystem Module 15-SP7 * openSUSE Leap 15.4 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves nine vulnerabilities and contains one feature can now be installed. ## Description: This update for cosign fixes the following issues: Update to version 3.0.5 (jsc#SLE-23879). Security issues fixed: * CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620). * CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253913). * CVE-2026-22703: Verification accepts any valid Rekor entry undercertain conditions (bsc#1256496). * CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256562). * CVE-2026-23991: github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned by TUF repository (bsc#1257080). * CVE-2026-23992: github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a compromised or misconfigured TUF repository (bsc#1257085). * CVE-2026-24122: improper validation of certificates that outlive expired CA certificates (bsc#1258542). * CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257139). * CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258612). Other updates and bugfixes: * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679) * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670) * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680) * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702) * chore(deps): bump the actions group with 3 updates (#4703) * update golang builder to use go1.25.7 (#4687) * update golangci-lint to v2.8.x (#4688) * Support DSSE signing conformance test (#4685) * chore(deps): bump the actions group across 1 directory with 8 updates (#4689) * Deprecate rekor-entry-type flag (#4691) * Deprecate cosign triangulate (#4676) * Deprecate cosign copy (#4681) * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683) * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668) * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673) * Automaticallyrequire signed timestamp with Rekor v2 entries (#4666) * Fix syntax issue in conformance test, update nightly (#4664) * Add mTLS support for TSA client connections when signing with a signing config (#4620) * fix: avoid panic on malformed tlog entry body (#4652) * Verify validity of chain rather than just certificate (#4663) * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626) * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662) * Bump sigstore/sigstore to resolve GHSA (#4660) * Gracefully fail if bundle payload body is not a string (#4648) * fix: avoid panic on malformed replace payload (#4653) * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659) * fix: avoid panic on malformed attestation payload (#4651) * fix: avoid panic on malformed tlog entries (#4649) * Update conformance to latest * docs(cosign): clarify RFC3161 revocation semantics (#4642) * Add empty predicate to cosign sign when payload type is application/vnd.in- toto+json (#4635) * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637) * Add origin key for ctfe trusted root * Add changelog updates for v3.0.4 and v2.6.2 (#4625) * Update to version 3.0.4: * Fix bundle verify path for old bundle/trusted root (#4623) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616) * chore(deps): bump cuelang.org/go in the gomod group (#4615) * Optimize cosign tree performance by caching digest resolution (#4612) * Don't require a trusted root to verify offline with a key (#4613) * Support default services for trusted-root and signing-config creation (#4592) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602) * chore(deps): bump github.com/sigstore/sigstore-go (#4578) * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601) * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611) * chore(deps): bump k8s.io/client-go from 0.34.3 to0.35.0 (#4604) * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588) * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586) * chore(deps): bump the gomod group with 5 updates (#4599) * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600) * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584) * chore(deps): bump the actions group with 3 updates (#4587) * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589) * chore(deps): bump the gomod group with 9 updates (#4577) * Update to version 3.0.3: * 4554: Closes 4554 - Add warning when --output* is used (#4556) * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545) * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542) * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543) * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546) * chore(deps): bump the actions group with 4 updates (#4544) * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567) * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568) * update builder to use go1.25.5 (#4566) * Protobuf bundle support for subcommand `clean` (#4539) * Add staging flag to initialize with staging TUF metadata * update slack invite link (#4560) * Updating sign-blob to also support signing with a certificate (#4547) * Bump sigstore library dependencies (#4532) * Protobuf bundle support for subcommands `save` and `load` (#4538) * Fix cert attachment for new bundle with signing config * Fix OCI verification with local cert - old bundle * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519) * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535) * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536) * update go builder and cosign (#4529) * chore(deps): bump the gomod group across 1 directory with 7 updates(#4528) * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520) * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515) * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518) * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524) * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521) * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502) * chore(deps): bump the actions group across 1 directory with 2 updates (#4516) * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523) * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522) * Deprecate tlog-upload flag (#4458) * fix: Use signal context for `sign` cli package. * update offline verification directions (#4526) * Fix signing/verifying annotations for new bundle * Add support to download and attach for protobuf bundles (#4477) * Add --signing-algorithm flag (#3497) * Refactor signcommon bundle helpers * Add --bundle and fix --upload for new bundle * Pass insecure registry flags through to referrers * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483) * Add protobuf bundle support for tree subcommand (#4491) * Remove stale embed import (#4492) * Support multiple container identities * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484) * chore(deps): bump chainguard-dev/actions in the actions group (#4480) * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485) * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486) * chore(deps): bump cuelang.org/go in the gomod group (#4479) * upgrade OSS-Fuzz build tooling (#4487) * Fix segfault when no attestations are found (#4472) * Use overridden repository for new bundle format (#4473) * update go to 1.25.3 (#4471) * Remove --out flag from `cosign initialize` (#4462) *chore(deps): bump the actions group with 2 updates (#4460) * Deprecate offline flag (#4457) * Deduplicate code in sign/attest _and verify_ commands (#4449) * Cache signing config when calling initialize (#4456) * Update changelog for v3.0.2 (#4455) * chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0 * chore(deps): bump gitlab.com/gitlab-org/api/client-go * chore(deps): bump the actions group with 3 updates * chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0 * choose different signature filename for KMS-signed release signatures (#4448) * chore(deps): bump github.com/go-jose/go-jose/v4 (#4451) * Update rekor-tiles version path * update CL for v3.0.1 release (#4447) * update goreleaser config for v3.0.0 release (#4446) * Create changelog for v3.0.0 (#4440) * Fetch service URLs from the TUF PGI signing config by default (#4428) * Create changelog for v2.6.1 (#4439) * chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432) * chore(deps): bump the gomod group with 2 updates (#4429) * chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433) * chore(deps): bump the actions group with 3 updates (#4434) * chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436) * chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437) * Bump module version to v3 for Cosign v3.0 (#4427) * Move sigstore-conformance back to tagged release (#4425) * Bump sigstore-go to v1.1.3 (#4423) * Partially populate the output of cosign verify when working with new bundles (#4416) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419) * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418) * chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420) * chore(deps): bump chainguard-dev/actions in the actions group (#4421) * bump go builder to use 1.25.1 andcosign (#4417) * Bump sigstore-go for more precise user agents (#4413) * chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408) * chore(deps): bump the actions group with 2 updates (#4407) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410) * chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411) * Default to using the new protobuf format (#4318) * Update to version 2.6.0: * Require exclusively a SigningConfig or service URLs when signing (#4403) * Add a terminal spinner while signing with sigstore-go (#4402) * Bump sigstore-go, support alternative hash algorithms with keys (#4386) * Add support for SigningConfig in sign/attest (#4371) * Support self-managed keys when signing with sigstore-go (#4368) * Remove SHA256 assumption in sign-blob/verify-blob (#4050) * introduce dockerfile to pin the go version to decouple go version from go.mod (#4369) * refactor: extract function to write referrer attestations (#4357) * Break import cycle with e2e build tag (#4370) * Update conformance test binary for signing config (#4367) * update builder image to use go1.25 (#4366) * Don't load content from TUF if trusted root path is specified (#4347) * Don't require timestamps when verifying with a key (#4337) * Fixes to cosign sign / verify for the new bundle format (#4346) * update builder to use go1.24.6 (#4334) * bump golangci-lint to v2.3.x (#4333) * Have cosign sign support bundle format (#4316) * Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319) * Verify subject with bundle only when checking claims (#4320) * Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the ability to verify with just a digest (#4306) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for yourproduct: * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-777=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-777=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-777=1 ## Package List: * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.35.1 * cosign-debuginfo-3.0.5-150400.3.35.1 * Basesystem Module 15-SP7 (noarch) * cosign-zsh-completion-3.0.5-150400.3.35.1 * cosign-bash-completion-3.0.5-150400.3.35.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * cosign-3.0.5-150400.3.35.1 * cosign-debuginfo-3.0.5-150400.3.35.1 * openSUSE Leap 15.4 (noarch) * cosign-zsh-completion-3.0.5-150400.3.35.1 * cosign-bash-completion-3.0.5-150400.3.35.1 * cosign-fish-completion-3.0.5-150400.3.35.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.35.1 * cosign-debuginfo-3.0.5-150400.3.35.1 ## References: * https://www.suse.com/security/cve/CVE-2025-11065.html * https://www.suse.com/security/cve/CVE-2025-58181.html * https://www.suse.com/security/cve/CVE-2026-22703.html * https://www.suse.com/security/cve/CVE-2026-22772.html * https://www.suse.com/security/cve/CVE-2026-23991.html * https://www.suse.com/security/cve/CVE-2026-23992.html * https://www.suse.com/security/cve/CVE-2026-24122.html * https://www.suse.com/security/cve/CVE-2026-24137.html * https://www.suse.com/security/cve/CVE-2026-26958.html * https://bugzilla.suse.com/show_bug.cgi?id=1250620 * https://bugzilla.suse.com/show_bug.cgi?id=1253913 * https://bugzilla.suse.com/show_bug.cgi?id=1256496 * https://bugzilla.suse.com/show_bug.cgi?id=1256562 * https://bugzilla.suse.com/show_bug.cgi?id=1257080 * https://bugzilla.suse.com/show_bug.cgi?id=1257085 * https://bugzilla.suse.com/show_bug.cgi?id=1257139 * https://bugzilla.suse.com/show_bug.cgi?id=1258542 * https://bugzilla.suse.com/show_bug.cgi?id=1258612 *https://jira.suse.com/browse/SLE-23879 . Moderate update for cosign resolves nine issues and enhances features on openSUSE. Important security fixes included.. cosign update, openSUSE patch, security advisories, Denial of service, moderate vulnerabilities. . LinuxSecurity.com Team
Mar 03, 2026
OpenSUSE
100
security advisorymoderatedenial of serviceSUSE Cosign Moderate Issue Advisory - 2026-0777-1 - DoS Exploits
An update that solves nine vulnerabilities and contains one feature can now be installed.. # Security update for cosign Announcement ID: SUSE-SU-2026:0777-1 Release Date: 2026-03-03T13:22:36Z Rating: moderate References: * bsc#1250620 * bsc#1253913 * bsc#1256496 * bsc#1256562 * bsc#1257080 * bsc#1257085 * bsc#1257139 * bsc#1258542 * bsc#1258612 * jsc#SLE-23879 Cross-References: * CVE-2025-11065 * CVE-2025-58181 * CVE-2026-22703 * CVE-2026-22772 * CVE-2026-23991 * CVE-2026-23992 * CVE-2026-24122 * CVE-2026-24137 * CVE-2026-26958 CVSS scores: * CVE-2025-11065 ( SUSE ): 5.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2025-11065 ( SUSE ): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N * CVE-2025-11065 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2025-58181 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-58181 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-58181 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-22703 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-22703 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-22703 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-22772 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N * CVE-2026-22772 ( SUSE ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N * CVE-2026-22772 ( NVD ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N * CVE-2026-23991 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-23991 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-23991 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-23991 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-23992 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-23992 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-23992 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-23992 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-24122 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24122 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24122 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24137 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-24137 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-24137 ( NVD ): 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N * CVE-2026-26958 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2026-26958 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2026-26958 ( NVD ): 1.7 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * Basesystem Module 15-SP7 * openSUSE Leap 15.4 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves nine vulnerabilities and contains one feature can now be installed. ## Description: This update for cosign fixes the following issues: Update to version 3.0.5 (jsc#SLE-23879). Security issues fixed: * CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620). * CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253913). * CVE-2026-22703: Verification accepts any valid Rekor entry undercertain conditions (bsc#1256496). * CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256562). * CVE-2026-23991: github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned by TUF repository (bsc#1257080). * CVE-2026-23992: github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a compromised or misconfigured TUF repository (bsc#1257085). * CVE-2026-24122: improper validation of certificates that outlive expired CA certificates (bsc#1258542). * CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257139). * CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258612). Other updates and bugfixes: * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679) * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670) * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680) * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702) * chore(deps): bump the actions group with 3 updates (#4703) * update golang builder to use go1.25.7 (#4687) * update golangci-lint to v2.8.x (#4688) * Support DSSE signing conformance test (#4685) * chore(deps): bump the actions group across 1 directory with 8 updates (#4689) * Deprecate rekor-entry-type flag (#4691) * Deprecate cosign triangulate (#4676) * Deprecate cosign copy (#4681) * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683) * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668) * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673) * Automaticallyrequire signed timestamp with Rekor v2 entries (#4666) * Fix syntax issue in conformance test, update nightly (#4664) * Add mTLS support for TSA client connections when signing with a signing config (#4620) * fix: avoid panic on malformed tlog entry body (#4652) * Verify validity of chain rather than just certificate (#4663) * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626) * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662) * Bump sigstore/sigstore to resolve GHSA (#4660) * Gracefully fail if bundle payload body is not a string (#4648) * fix: avoid panic on malformed replace payload (#4653) * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659) * fix: avoid panic on malformed attestation payload (#4651) * fix: avoid panic on malformed tlog entries (#4649) * Update conformance to latest * docs(cosign): clarify RFC3161 revocation semantics (#4642) * Add empty predicate to cosign sign when payload type is application/vnd.in- toto+json (#4635) * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637) * Add origin key for ctfe trusted root * Add changelog updates for v3.0.4 and v2.6.2 (#4625) * Update to version 3.0.4: * Fix bundle verify path for old bundle/trusted root (#4623) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616) * chore(deps): bump cuelang.org/go in the gomod group (#4615) * Optimize cosign tree performance by caching digest resolution (#4612) * Don't require a trusted root to verify offline with a key (#4613) * Support default services for trusted-root and signing-config creation (#4592) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602) * chore(deps): bump github.com/sigstore/sigstore-go (#4578) * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601) * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611) * chore(deps): bump k8s.io/client-go from 0.34.3 to0.35.0 (#4604) * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588) * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586) * chore(deps): bump the gomod group with 5 updates (#4599) * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600) * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584) * chore(deps): bump the actions group with 3 updates (#4587) * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589) * chore(deps): bump the gomod group with 9 updates (#4577) * Update to version 3.0.3: * 4554: Closes 4554 - Add warning when --output* is used (#4556) * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545) * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542) * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543) * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546) * chore(deps): bump the actions group with 4 updates (#4544) * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567) * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568) * update builder to use go1.25.5 (#4566) * Protobuf bundle support for subcommand `clean` (#4539) * Add staging flag to initialize with staging TUF metadata * update slack invite link (#4560) * Updating sign-blob to also support signing with a certificate (#4547) * Bump sigstore library dependencies (#4532) * Protobuf bundle support for subcommands `save` and `load` (#4538) * Fix cert attachment for new bundle with signing config * Fix OCI verification with local cert - old bundle * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519) * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535) * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536) * update go builder and cosign (#4529) * chore(deps): bump the gomod group across 1 directory with 7 updates(#4528) * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520) * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515) * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518) * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524) * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521) * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502) * chore(deps): bump the actions group across 1 directory with 2 updates (#4516) * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523) * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522) * Deprecate tlog-upload flag (#4458) * fix: Use signal context for `sign` cli package. * update offline verification directions (#4526) * Fix signing/verifying annotations for new bundle * Add support to download and attach for protobuf bundles (#4477) * Add --signing-algorithm flag (#3497) * Refactor signcommon bundle helpers * Add --bundle and fix --upload for new bundle * Pass insecure registry flags through to referrers * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483) * Add protobuf bundle support for tree subcommand (#4491) * Remove stale embed import (#4492) * Support multiple container identities * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484) * chore(deps): bump chainguard-dev/actions in the actions group (#4480) * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485) * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486) * chore(deps): bump cuelang.org/go in the gomod group (#4479) * upgrade OSS-Fuzz build tooling (#4487) * Fix segfault when no attestations are found (#4472) * Use overridden repository for new bundle format (#4473) * update go to 1.25.3 (#4471) * Remove --out flag from `cosign initialize` (#4462) *chore(deps): bump the actions group with 2 updates (#4460) * Deprecate offline flag (#4457) * Deduplicate code in sign/attest _and verify_ commands (#4449) * Cache signing config when calling initialize (#4456) * Update changelog for v3.0.2 (#4455) * chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0 * chore(deps): bump gitlab.com/gitlab-org/api/client-go * chore(deps): bump the actions group with 3 updates * chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0 * choose different signature filename for KMS-signed release signatures (#4448) * chore(deps): bump github.com/go-jose/go-jose/v4 (#4451) * Update rekor-tiles version path * update CL for v3.0.1 release (#4447) * update goreleaser config for v3.0.0 release (#4446) * Create changelog for v3.0.0 (#4440) * Fetch service URLs from the TUF PGI signing config by default (#4428) * Create changelog for v2.6.1 (#4439) * chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432) * chore(deps): bump the gomod group with 2 updates (#4429) * chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433) * chore(deps): bump the actions group with 3 updates (#4434) * chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436) * chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437) * Bump module version to v3 for Cosign v3.0 (#4427) * Move sigstore-conformance back to tagged release (#4425) * Bump sigstore-go to v1.1.3 (#4423) * Partially populate the output of cosign verify when working with new bundles (#4416) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419) * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418) * chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420) * chore(deps): bump chainguard-dev/actions in the actions group (#4421) * bump go builder to use 1.25.1 andcosign (#4417) * Bump sigstore-go for more precise user agents (#4413) * chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408) * chore(deps): bump the actions group with 2 updates (#4407) * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410) * chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411) * Default to using the new protobuf format (#4318) * Update to version 2.6.0: * Require exclusively a SigningConfig or service URLs when signing (#4403) * Add a terminal spinner while signing with sigstore-go (#4402) * Bump sigstore-go, support alternative hash algorithms with keys (#4386) * Add support for SigningConfig in sign/attest (#4371) * Support self-managed keys when signing with sigstore-go (#4368) * Remove SHA256 assumption in sign-blob/verify-blob (#4050) * introduce dockerfile to pin the go version to decouple go version from go.mod (#4369) * refactor: extract function to write referrer attestations (#4357) * Break import cycle with e2e build tag (#4370) * Update conformance test binary for signing config (#4367) * update builder image to use go1.25 (#4366) * Don't load content from TUF if trusted root path is specified (#4347) * Don't require timestamps when verifying with a key (#4337) * Fixes to cosign sign / verify for the new bundle format (#4346) * update builder to use go1.24.6 (#4334) * bump golangci-lint to v2.3.x (#4333) * Have cosign sign support bundle format (#4316) * Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319) * Verify subject with bundle only when checking claims (#4320) * Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the ability to verify with just a digest (#4306) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for yourproduct: * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-777=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-777=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-777=1 ## Package List: * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.35.1 * cosign-debuginfo-3.0.5-150400.3.35.1 * Basesystem Module 15-SP7 (noarch) * cosign-zsh-completion-3.0.5-150400.3.35.1 * cosign-bash-completion-3.0.5-150400.3.35.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * cosign-3.0.5-150400.3.35.1 * cosign-debuginfo-3.0.5-150400.3.35.1 * openSUSE Leap 15.4 (noarch) * cosign-zsh-completion-3.0.5-150400.3.35.1 * cosign-bash-completion-3.0.5-150400.3.35.1 * cosign-fish-completion-3.0.5-150400.3.35.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * cosign-3.0.5-150400.3.35.1 * cosign-debuginfo-3.0.5-150400.3.35.1 ## References: * https://www.suse.com/security/cve/CVE-2025-11065.html * https://www.suse.com/security/cve/CVE-2025-58181.html * https://www.suse.com/security/cve/CVE-2026-22703.html * https://www.suse.com/security/cve/CVE-2026-22772.html * https://www.suse.com/security/cve/CVE-2026-23991.html * https://www.suse.com/security/cve/CVE-2026-23992.html * https://www.suse.com/security/cve/CVE-2026-24122.html * https://www.suse.com/security/cve/CVE-2026-24137.html * https://www.suse.com/security/cve/CVE-2026-26958.html * https://bugzilla.suse.com/show_bug.cgi?id=1250620 * https://bugzilla.suse.com/show_bug.cgi?id=1253913 * https://bugzilla.suse.com/show_bug.cgi?id=1256496 * https://bugzilla.suse.com/show_bug.cgi?id=1256562 * https://bugzilla.suse.com/show_bug.cgi?id=1257080 * https://bugzilla.suse.com/show_bug.cgi?id=1257085 * https://bugzilla.suse.com/show_bug.cgi?id=1257139 * https://bugzilla.suse.com/show_bug.cgi?id=1258542 * https://bugzilla.suse.com/show_bug.cgi?id=1258612 *https://jira.suse.com/browse/SLE-23879 . Update for Cosign addresses nine security issues on SUSE, including moderate threats and crucial fixes for known exploits.. SUSE Update, Cosign Security, Moderate Threats, Vulnerabilities Fix, Open Source Applications. . LinuxSecurity.com Team
Mar 03, 2026
SuSE
202
security advisorymoderatesecurity updateopenSUSE Tumbleweed Cosign Security Report 2026-10235-1
An update that solves 6 vulnerabilities can now be installed.. # cosign-3.0.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:10235-1 Rating: moderate Cross-References: * CVE-2026-22772 * CVE-2026-23991 * CVE-2026-23992 * CVE-2026-24122 * CVE-2026-24137 * CVE-2026-26958 CVSS scores: * CVE-2026-22772 ( SUSE ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N * CVE-2026-22772 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N * CVE-2026-23991 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-23991 ( SUSE ): 6 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-23992 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-23992 ( SUSE ): 6 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-24122 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24122 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24137 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-24137 ( SUSE ): 6 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-26958 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2026-26958 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 6 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the cosign-3.0.5-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * cosign 3.0.5-1.1 * cosign-bash-completion 3.0.5-1.1 * cosign-fish-completion 3.0.5-1.1 * cosign-zsh-completion 3.0.5-1.1 ## References: * https://www.suse.com/security/cve/CVE-2026-22772.html * https://www.suse.com/security/cve/CVE-2026-23991.html * https://www.suse.com/security/cve/CVE-2026-23992.html * https://www.suse.com/security/cve/CVE-2026-24122.html *https://www.suse.com/security/cve/CVE-2026-24137.html * https://www.suse.com/security/cve/CVE-2026-26958.html . Explore the important security update for cosign-3.0.5-1.1 in openSUSE Tumbleweed, addressing multiple issues.. openSUSE Tumbleweed, cosign update, moderates risks, security patches. . LinuxSecurity.com Team
Feb 24, 2026
OpenSUSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!