An update that fixes one vulnerability, contains one feature is now available. . SUSE Security Update: Security update for cosign ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3486-1 Rating: important References: #1203430 SLE-23879 Cross-References: CVE-2022-36056 CVSS scores: CVE-2022-36056 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability, contains one feature is now available. Description: This update for cosign fixes the following issues: Updated to version 1.12.0 (jsc#SLE-23879): - CVE-2022-36056: Fixed verify-blob could successfully verify an artifact when verification should have failed (bsc#1203430). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3486=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3486=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): cosign-1.12.0-150400.3.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390xx86_64): cosign-1.12.0-150400.3.6.1 References: https://www.suse.com/security/cve/CVE-2022-36056.html https://bugzilla.suse.com/1203430 . SUSE has released a vital security patch for cosign, resolving a severe vulnerability related to validation as logged under CVE-2022-36056. Please ensure your systems are updated immediately.. SUSE Security,cirs,o openSUSE,cosign Patch. . Severity: Important. LinuxSecurity.com Team
The security update announced as DSA-3904-1 in bind9 introduced a regression. The fix for CVE-2017-3142 broke verification of TSIG signed TCP message sequences where not all the messages contain TSIG records. This is conform to the spec and may be used in AXFR and IXFR response. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3904-2
Get the latest Linux and open source security news straight to your inbox.