cosign-3.0.5-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2026:10235-1 Final 1 1 2026-02-23T00:00:00Z current 2026-02-23T00:00:00Z 2026-02-23T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z cosign-3.0.5-1.1 on GA media These are all security issues fixed in the cosign-3.0.5-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2026-10235 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2026-22772/ SUSE CVE CVE-2026-22772 page https://www.suse.com/security/cve/CVE-2026-23991/ SUSE CVE CVE-2026-23991 page https://www.suse.com/security/cve/CVE-2026-23992/ SUSE CVE CVE-2026-23992 page https://www.suse.com/security/cve/CVE-2026-24122/ SUSE CVE CVE-2026-24122 page https://www.suse.com/security/cve/CVE-2026-24137/ SUSE CVE CVE-2026-24137 page https://www.suse.com/security/cve/CVE-2026-26958/ SUSE CVE CVE-2026-26958 page openSUSE Tumbleweed cosign-3.0.5-1.1 cosign-bash-completion-3.0.5-1.1 cosign-fish-completion-3.0.5-1.1 cosign-zsh-completion-3.0.5-1.1 cosign-3.0.5-1.1 as a component of openSUSE Tumbleweed cosign-bash-completion-3.0.5-1.1 as a component of openSUSE Tumbleweed cosign-fish-completion-3.0.5-1.1 as a component of openSUSE Tumbleweed cosign-zsh-completion-3.0.5-1.1 as a component of openSUSE Tumbleweed Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5. CVE-2026-22772 openSUSE Tumbleweed:cosign-3.0.5-1.1 openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2026-22772.html CVE-2026-22772 https://bugzilla.suse.com/1256532 SUSE Bug 1256532 go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available. CVE-2026-23991 openSUSE Tumbleweed:cosign-3.0.5-1.1 openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2026-23991.html CVE-2026-23991 https://bugzilla.suse.com/1257079 SUSE Bug 1257079 go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1. CVE-2026-23992 openSUSE Tumbleweed:cosign-3.0.5-1.1 openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2026-23992.html CVE-2026-23992 https://bugzilla.suse.com/1257084 SUSE Bug 1257084 Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5. CVE-2026-24122 openSUSE Tumbleweed:cosign-3.0.5-1.1 openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2026-24122.html CVE-2026-24122 https://bugzilla.suse.com/1258540 SUSE Bug 1258540 sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release. CVE-2026-24137 openSUSE Tumbleweed:cosign-3.0.5-1.1 openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2026-24137.html CVE-2026-24137 https://bugzilla.suse.com/1257137 SUSE Bug 1257137 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1. CVE-2026-26958 openSUSE Tumbleweed:cosign-3.0.5-1.1 openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1 openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2026-26958.html CVE-2026-26958 https://bugzilla.suse.com/1258570 SUSE Bug 1258570