484 matches found
Security update for cosign
This update for cosign fixes the following issues: CVE-2024-6104: cosign: hashicorp/go-retryablehttp: Fixed sensitive information disclosure to log file bsc1227031 CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Fixed bad documentation of error handling in ParseWithClaims leading to...
SUSE-SU-2025:1333-1 Security update for cosign
This update for cosign fixes the following issues: - CVE-2024-6104: cosign: hashicorp/go-retryablehttp: Fixed sensitive information disclosure to log file bsc1227031 - CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Fixed bad documentation of error handling in ParseWithClaims leading to...
cosign-2.5.0-1.1 on GA media (moderate)
cosign-2.5.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:14988-1 Rating: moderate Cross-References: CVE-2024-51744 CVE-2024-6104 CVE-2025-22868 CVE-2025-22869 CVE-2025-22870 CVE-2025-27144 CVSS scores: CVE-2024-51744 SUSE : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2024-51744 SUS...
OPENSUSE-SU-2025:14988-1 cosign-2.5.0-1.1 on GA media
These are all security issues fixed in the cosign-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed...
Improper Verification of Cryptographic Signature
Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the matchSignatures function in cosign.go, which does not check for subjectRegExp or issuerRegExp values during artifact signature verification. An attacker can deploy unauthorized...
GHSA-3WHM-J4XM-RV8X vulnerabilities
Vulnerabilities for packages: linkerd2, tkn, spqr, yam, yace, sbomqs, task, rabbitmq-default-user-credential-updater, sbom-scorecard, cue, ksops, vertical-pod-autoscaler, melange, kiali, nri-jmx, libnvidia-container, crossplane-provider-aws-ec2, flux-image-reflector-controller, gatus,...
CVE-2025-22866 vulnerabilities
Vulnerabilities for packages: linkerd2, tkn, spqr, yam, yace, sbomqs, task, rabbitmq-default-user-credential-updater, sbom-scorecard, cue, ksops, vertical-pod-autoscaler, melange, kiali, nri-jmx, libnvidia-container, crossplane-provider-aws-ec2, flux-image-reflector-controller, gatus,...
CVE-2024-45395 vulnerabilities
Vulnerabilities for packages: slsa-verifier, cosign, gh...
CVE-2024-45395 vulnerabilities
Vulnerabilities for packages: gh, cosign, slsa-verifier, cosign-fips...
GHSA-CQ38-JH5F-37MQ vulnerabilities
Vulnerabilities for packages: slsa-verifier, cosign, gh...
GHSA-CQ38-JH5F-37MQ vulnerabilities
Vulnerabilities for packages: gh, cosign, slsa-verifier, cosign-fips...
GHSA-C77R-FH37-X2PX vulnerabilities
Vulnerabilities for packages: k8sgpt, conftest, snyk-cli, zot, zarf, kubescape, kots, policy-controller, spire-server, cosign, opa, tfsec...
GHSA-C77R-FH37-X2PX vulnerabilities
Vulnerabilities for packages: kots, cosign, zot, conftest, k8sgpt, spire-server, spire-server-fips, conftest-fips, kubescape, policy-controller, policy-controller-fips, snyk-cli, zarf, tfsec, cosign-fips, opa...
CVE-2024-8260 vulnerabilities
Vulnerabilities for packages: k8sgpt, conftest, snyk-cli, zot, zarf, kubescape, kots, policy-controller, spire-server, cosign, opa, tfsec...
CVE-2024-8260 vulnerabilities
Vulnerabilities for packages: kots, cosign, zot, conftest, k8sgpt, spire-server, spire-server-fips, conftest-fips, kubescape, policy-controller, policy-controller-fips, snyk-cli, zarf, tfsec, cosign-fips, opa...
openSUSE Security Advisory (SUSE-SU-2024:1486-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
cosign: Malicious artifects can cause machine-wide denial of service
A flaw was found in the Cosign package where maliciously crafted software artifacts can trigger uncontrolled resource consumption by allocating too much memory and starving out the system. A successful attack may result in a denial of service of the machine running Cosign, impacting availability...
cosign: Malicious attachments can cause system-wide denial of service
A flaw was found in the Cosign package where a malicious attachment may trigger uncontrolled resource consumption by allocating too much memory. This flaw allows an attacker to craft a malicious attachment, resulting in a denial of service, possibly impacting other applications running on the sam...
SUSE-SU-2024:1486-2 Security update for cosign
This update for cosign fixes the following issues: - CVE-2024-29902: Fixed denial of service on host machine via remote image with a malicious attachments bsc1222835 - CVE-2024-29903: Fixed denial of service on host machine via malicious software artifacts bsc1222837 Other fixes: - Updated to 2.2...