SUSE-SU-2026:1098-1: cosign&distro=openSUSE Leap 15.6
Published
Published 26-03-2026Last modified 28-03-2026
Vulnerability summary
SUSE-SU-2026:1098-1 is a vulnerability in cosign&distro=openSUSE Leap 15.6 with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 26-03-2026PublishedVulnerability first disclosed.
- 28-03-2026Last modifiedVulnerability information updated.
Description
Security update for cosign This update for cosign rebuilds it against the current go 1.25 security release.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in the CISA KEV catalog.
Not in the ENISA CNW catalog.
Not in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse11 products
- cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.0.5-150400.3.37.1
- cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.0.5-150400.3.37.1
- cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 3.0.5-150400.3.37.1
- cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 3.0.5-150400.3.37.1
- cosign&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 3.0.5-150400.3.37.1
- cosign&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 3.0.5-150400.3.37.1
- cosign&distro=SUSE Linux Enterprise Server 15 SP5-LTSS< 3.0.5-150400.3.37.1
- cosign&distro=SUSE Linux Enterprise Server 15 SP6-LTSS< 3.0.5-150400.3.37.1
- cosign&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4< 3.0.5-150400.3.37.1
- cosign&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5< 3.0.5-150400.3.37.1
- cosign&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6< 3.0.5-150400.3.37.1
Opensuse1 product
- cosign&distro=openSUSE Leap 15.6< 3.0.5-150400.3.37.1
2 vendors · 12 products
References
1 linksRelated vulnerabilities
Insufficient evidenceSUSE-SU-2026:4903-1SUSE Linux Enterprisesuse · cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS +10 moresuse cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSecurity update for cosign
This update for cosign rebuilds it against the current go security release.CVSSUnscoredInsufficient evidenceSUSE-SU-2026:3954-1SUSE Linux Enterprisesuse · cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS +10 moresuse cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSecurity update for cosign
This update for cosign rebuilds it against the current go security release.CVSSUnscoredInsufficient evidenceSUSE-SU-2026:3068-1SUSE Linux Enterprisesuse · cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS +10 moresuse cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSecurity update for cosign
This update for cosign rebuilds it against the current go security release.CVSSUnscoredInsufficient evidenceSUSE-SU-2026:0777-1opensuse · cosign&distro=openSUSE Leap 15.6 +1 moreopensuse cosign&distro=openSUSE Leap 15.6Security update for cosign
This update for cosign fixes the following issues:
Update to version 3.0.5 (jsc#SLE-23879).
Security issues fixed:
- CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620).
- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption
(bsc#1253913).
- CVE-2026-22703: Verification accepts any valid Rekor entry under certain conditions (bsc#1256496).
- CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary
internal services (bsc#1256562).
- CVE-2026-23991: github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned
by TUF repository (bsc#1257080).
- CVE-2026-23992: github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a
compromised or misconfigured TUF repository (bsc#1257085).
- CVE-2026-24122: improper validation of certificates that outlive expired CA certificates (bsc#1258542).
- CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target
cache path traversal (bsc#1257139).
- CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results
and lead to undefined behavior (bsc#1258612).
Other updates and bugfixes:
* chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)
* chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)
* chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)
* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)
* chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)
* chore(deps): bump the actions group with 3 updates (#4703)
* update golang builder to use go1.25.7 (#4687)
* update golangci-lint to v2.8.x (#4688)
* Support DSSE signing conformance test (#4685)
* chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
* Deprecate rekor-entry-type flag (#4691)
* Deprecate cosign triangulate (#4676)
* Deprecate cosign copy (#4681)
* Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
* chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)
* chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
* Automatically require signed timestamp with Rekor v2 entries (#4666)
* Fix syntax issue in conformance test, update nightly (#4664)
* Add mTLS support for TSA client connections when signing with a signing config (#4620)
* fix: avoid panic on malformed tlog entry body (#4652)
* Verify validity of chain rather than just certificate (#4663)
* Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
* chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)
* Bump sigstore/sigstore to resolve GHSA (#4660)
* Gracefully fail if bundle payload body is not a string (#4648)
* fix: avoid panic on malformed replace payload (#4653)
* chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)
* fix: avoid panic on malformed attestation payload (#4651)
* fix: avoid panic on malformed tlog entries (#4649)
* Update conformance to latest
* docs(cosign): clarify RFC3161 revocation semantics (#4642)
* Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
* chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)
* Add origin key for ctfe trusted root
* Add changelog updates for v3.0.4 and v2.6.2 (#4625)
- Update to version 3.0.4:
* Fix bundle verify path for old bundle/trusted root (#4623)
* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)
* chore(deps): bump cuelang.org/go in the gomod group (#4615)
* Optimize cosign tree performance by caching digest resolution (#4612)
* Don't require a trusted root to verify offline with a key (#4613)
* Support default services for trusted-root and signing-config creation (#4592)
* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)
* chore(deps): bump github.com/sigstore/sigstore-go (#4578)
* chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)
* chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)
* chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)
* chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)
* chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)
* chore(deps): bump the gomod group with 5 updates (#4599)
* chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)
* chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)
* chore(deps): bump the actions group with 3 updates (#4587)
* chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)
* chore(deps): bump the gomod group with 9 updates (#4577)
- Update to version 3.0.3:
* 4554: Closes 4554 - Add warning when --output* is used (#4556)
* chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)
* chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)
* chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)
* chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)
* chore(deps): bump the actions group with 4 updates (#4544)
* chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)
* chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)
* update builder to use go1.25.5 (#4566)
* Protobuf bundle support for subcommand `clean` (#4539)
* Add staging flag to initialize with staging TUF metadata
* update slack invite link (#4560)
* Updating sign-blob to also support signing with a certificate (#4547)
* Bump sigstore library dependencies (#4532)
* Protobuf bundle support for subcommands `save` and `load` (#4538)
* Fix cert attachment for new bundle with signing config
* Fix OCI verification with local cert - old bundle
* chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)
* chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)
* chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)
* update go builder and cosign (#4529)
* chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)
* chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)
* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)
* chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)
* chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)
* chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)
* chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)
* chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)
* chore(deps): bump the actions group across 1 directory with 2 updates (#4516)
* chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)
* chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)
* Deprecate tlog-upload flag (#4458)
* fix: Use signal context for `sign` cli package.
* update offline verification directions (#4526)
* Fix signing/verifying annotations for new bundle
* Add support to download and attach for protobuf bundles (#4477)
* Add --signing-algorithm flag (#3497)
* Refactor signcommon bundle helpers
* Add --bundle and fix --upload for new bundle
* Pass insecure registry flags through to referrers
* chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)
* Add protobuf bundle support for tree subcommand (#4491)
* Remove stale embed import (#4492)
* Support multiple container identities
* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)
* chore(deps): bump chainguard-dev/actions in the actions group (#4480)
* chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)
* chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)
* chore(deps): bump cuelang.org/go in the gomod group (#4479)
* upgrade OSS-Fuzz build tooling (#4487)
* Fix segfault when no attestations are found (#4472)
* Use overridden repository for new bundle format (#4473)
* update go to 1.25.3 (#4471)
* Remove --out flag from `cosign initialize` (#4462)
* chore(deps): bump the actions group with 2 updates (#4460)
* Deprecate offline flag (#4457)
* Deduplicate code in sign/attest* and verify* commands (#4449)
* Cache signing config when calling initialize (#4456)
* Update changelog for v3.0.2 (#4455)
* chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0
* chore(deps): bump gitlab.com/gitlab-org/api/client-go
* chore(deps): bump the actions group with 3 updates
* chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0
* choose different signature filename for KMS-signed release signatures (#4448)
* chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)
* Update rekor-tiles version path
* update CL for v3.0.1 release (#4447)
* update goreleaser config for v3.0.0 release (#4446)
* Create changelog for v3.0.0 (#4440)
* Fetch service URLs from the TUF PGI signing config by default (#4428)
* Create changelog for v2.6.1 (#4439)
* chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)
* chore(deps): bump the gomod group with 2 updates (#4429)
* chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)
* chore(deps): bump the actions group with 3 updates (#4434)
* chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)
* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)
* chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)
* Bump module version to v3 for Cosign v3.0 (#4427)
* Move sigstore-conformance back to tagged release (#4425)
* Bump sigstore-go to v1.1.3 (#4423)
* Partially populate the output of cosign verify when working with new bundles (#4416)
* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)
* chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)
* chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)
* chore(deps): bump chainguard-dev/actions in the actions group (#4421)
* bump go builder to use 1.25.1 and cosign (#4417)
* Bump sigstore-go for more precise user agents (#4413)
* chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)
* chore(deps): bump the actions group with 2 updates (#4407)
* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)
* chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)
* Default to using the new protobuf format (#4318)
- Update to version 2.6.0:
* Require exclusively a SigningConfig or service URLs when signing (#4403)
* Add a terminal spinner while signing with sigstore-go (#4402)
* Bump sigstore-go, support alternative hash algorithms with keys (#4386)
* Add support for SigningConfig in sign/attest (#4371)
* Support self-managed keys when signing with sigstore-go (#4368)
* Remove SHA256 assumption in sign-blob/verify-blob (#4050)
* introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)
* refactor: extract function to write referrer attestations (#4357)
* Break import cycle with e2e build tag (#4370)
* Update conformance test binary for signing config (#4367)
* update builder image to use go1.25 (#4366)
* Don't load content from TUF if trusted root path is specified (#4347)
* Don't require timestamps when verifying with a key (#4337)
* Fixes to cosign sign / verify for the new bundle format (#4346)
* update builder to use go1.24.6 (#4334)
* bump golangci-lint to v2.3.x (#4333)
* Have cosign sign support bundle format (#4316)
* Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
* Verify subject with bundle only when checking claims (#4320)
* Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the
ability to verify with just a digest (#4306)CVSSUnscoredRoutineCVE-2025-46569open-policy-agent · opa +93 moreOPA server Data API HTTP path injection of RegoOpen Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. This issue has been patched in version 1.4.0. A workaround involves having network access to OPA’s RESTful APIs being limited to `localhost` and/or trusted networks, unless necessary for production reasons.CVSS7.4HighEPSS0.54%Insufficient evidenceSUSE-SU-2025:1333-1opensuse · cosign&distro=openSUSE Leap 15.6 +11 moreopensuse cosign&distro=openSUSE Leap 15.6Security update for cosign
This update for cosign fixes the following issues:
- CVE-2024-6104: cosign: hashicorp/go-retryablehttp: Fixed sensitive information disclosure to log file (bsc#1227031)
- CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Fixed bad documentation of error handling in ParseWithClaims leading to potentially dangerous situations (bsc#1232985)
- CVE-2025-27144: cosign: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Fixed denial of service in Go JOSE's Parsing (bsc#1237682)
- CVE-2025-22870: cosign: golang.org/x/net/proxy: Fixed proxy bypass using IPv6 zone IDs (bsc#1238693)
- CVE-2025-22868: cosign: golang.org/x/oauth2/jws: Fixed unexpected memory consumption during token parsing (bsc#1239204)
- CVE-2025-22869: cosign: golang.org/x/crypto/ssh: Fixed denial of service in the Key Exchange (bsc#1239337)
Other fixes:
- Update to version 2.5.0 (jsc#SLE-23476):
* Update sigstore-go to pick up bug fixes (#4150)
* Update golangci-lint to v2, update golangci-lint-action (#4143)
* Feat/non filename completions (#4115)
* update builder to use go1.24.1 (#4116)
* Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
* Remove cert log line (#4113)
* cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
* bump to latest scaffolding release for testing (#4099)
* increase 2e2_test docker compose tiemout to 180s (#4091)
* Fix replace with compliant image mediatype (#4077)
* Add TSA certificate related flags and fields for cosign attest (#4079)
- Update to version 2.4.3 (jsc#SLE-23476):
* Enable fetching signatures without remote get. (#4047)
* Bump sigstore/sigstore to support KMS plugins (#4073)
* sort properly Go imports (#4071)
* sync comment with parameter name in function signature (#4063)
* fix go imports order to be alphabetical (#4062)
* fix comment typo and imports order (#4061)
* Feat/file flag completion improvements (#4028)
* Udpate builder to use go1.23.6 (#4052)
* Refactor verifyNewBundle into library function (#4013)
* fix parsing error in --only for cosign copy (#4049)
* Fix codeowners syntax, add dep-maintainers (#4046)
- Update to version 2.4.2 (jsc#SLE-23476):
- Updated open-policy-agent to 1.1.0 library (#4036)
- Note that only Rego v0 policies are supported at this time
- Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
- Add support for verifying root checksum in cosign initialize (#3953)
- Detect if user supplied a valid protobuf bundle (#3931)
- Add a log message if user doesn't provide --trusted-root (#3933)
- Support mTLS towards container registry (#3922)
- Add bundle create helper command (#3901)
- Add trusted-root create helper command (#3876)
Bug Fixes:
- fix: set tls config while retaining other fields from default http transport (#4007)
- policy fuzzer: ignore known panics (#3993)
- Fix for multiple WithRemote options (#3982)
- Add nightly conformance test workflow (#3979)
- Fix copy --only for signatures + update/align docs (#3904)CVSSUnscored