OPENSUSE-SU-2026:22064-1: cosign&distro=openSUSE Leap 16.0 openSUSE

Vulnerability summary

OPENSUSE-SU-2026:22064-1 is a vulnerability in cosign&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.

Timeline

1. 09-10-2026
   PublishedVulnerability first disclosed.
2. 19-10-2026
   Last modifiedVulnerability information updated.

Description

Security update for cosign This update for cosign fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117). - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278614). - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025). - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215). - Verification bypass via public key in legacy bundle (bsc#1282542). Changes for cosign: - update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98): * This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle. * Auto-detect default digest algorithm for public keys * fix(pkcs11key): return an error instead of panicking when no key pair matches * Supporting OCI Signing with X.509 Certificate Chain * test(inspect): replace mock TSA client usage with local timestamp response generator in * fix: prevent shell completions for various options not taking filenames * fix(blob): compare file checksums case-insensitively in * Verification bypass via public key in legacy bundle (GHSA- fx35-mq7g-6g98)

No weakness data has been published for this record.