Vulnerability-Lookup

OPENSUSE-SU-2026:10235-1

Vulnerability from csaf_opensuse - Published: 2026-02-23 00:00 - Updated: 2026-02-23 00:00

Summary

cosign-3.0.5-1.1 on GA media

Notes

Title of the patch

cosign-3.0.5-1.1 on GA media

Description of the patch

These are all security issues fixed in the cosign-3.0.5-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2026-10235

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "cosign-3.0.5-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the cosign-3.0.5-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10235",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10235-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-22772 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-22772/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23991 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23991/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23992 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23992/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24122 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24122/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24137 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24137/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26958 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26958/"
      }
    ],
    "title": "cosign-3.0.5-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-02-23T00:00:00Z",
      "generator": {
        "date": "2026-02-23T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10235-1",
      "initial_release_date": "2026-02-23T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-02-23T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-1.1.aarch64",
                "product": {
                  "name": "cosign-3.0.5-1.1.aarch64",
                  "product_id": "cosign-3.0.5-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-3.0.5-1.1.aarch64",
                "product": {
                  "name": "cosign-bash-completion-3.0.5-1.1.aarch64",
                  "product_id": "cosign-bash-completion-3.0.5-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-3.0.5-1.1.aarch64",
                "product": {
                  "name": "cosign-fish-completion-3.0.5-1.1.aarch64",
                  "product_id": "cosign-fish-completion-3.0.5-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-3.0.5-1.1.aarch64",
                "product": {
                  "name": "cosign-zsh-completion-3.0.5-1.1.aarch64",
                  "product_id": "cosign-zsh-completion-3.0.5-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-1.1.ppc64le",
                "product": {
                  "name": "cosign-3.0.5-1.1.ppc64le",
                  "product_id": "cosign-3.0.5-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-3.0.5-1.1.ppc64le",
                "product": {
                  "name": "cosign-bash-completion-3.0.5-1.1.ppc64le",
                  "product_id": "cosign-bash-completion-3.0.5-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-3.0.5-1.1.ppc64le",
                "product": {
                  "name": "cosign-fish-completion-3.0.5-1.1.ppc64le",
                  "product_id": "cosign-fish-completion-3.0.5-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-3.0.5-1.1.ppc64le",
                "product": {
                  "name": "cosign-zsh-completion-3.0.5-1.1.ppc64le",
                  "product_id": "cosign-zsh-completion-3.0.5-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-1.1.s390x",
                "product": {
                  "name": "cosign-3.0.5-1.1.s390x",
                  "product_id": "cosign-3.0.5-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-3.0.5-1.1.s390x",
                "product": {
                  "name": "cosign-bash-completion-3.0.5-1.1.s390x",
                  "product_id": "cosign-bash-completion-3.0.5-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-3.0.5-1.1.s390x",
                "product": {
                  "name": "cosign-fish-completion-3.0.5-1.1.s390x",
                  "product_id": "cosign-fish-completion-3.0.5-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-3.0.5-1.1.s390x",
                "product": {
                  "name": "cosign-zsh-completion-3.0.5-1.1.s390x",
                  "product_id": "cosign-zsh-completion-3.0.5-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-1.1.x86_64",
                "product": {
                  "name": "cosign-3.0.5-1.1.x86_64",
                  "product_id": "cosign-3.0.5-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-3.0.5-1.1.x86_64",
                "product": {
                  "name": "cosign-bash-completion-3.0.5-1.1.x86_64",
                  "product_id": "cosign-bash-completion-3.0.5-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-3.0.5-1.1.x86_64",
                "product": {
                  "name": "cosign-fish-completion-3.0.5-1.1.x86_64",
                  "product_id": "cosign-fish-completion-3.0.5-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-3.0.5-1.1.x86_64",
                "product": {
                  "name": "cosign-zsh-completion-3.0.5-1.1.x86_64",
                  "product_id": "cosign-zsh-completion-3.0.5-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64"
        },
        "product_reference": "cosign-3.0.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le"
        },
        "product_reference": "cosign-3.0.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x"
        },
        "product_reference": "cosign-3.0.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64"
        },
        "product_reference": "cosign-3.0.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-3.0.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64"
        },
        "product_reference": "cosign-bash-completion-3.0.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-3.0.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le"
        },
        "product_reference": "cosign-bash-completion-3.0.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-3.0.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x"
        },
        "product_reference": "cosign-bash-completion-3.0.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-3.0.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64"
        },
        "product_reference": "cosign-bash-completion-3.0.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-3.0.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64"
        },
        "product_reference": "cosign-fish-completion-3.0.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-3.0.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le"
        },
        "product_reference": "cosign-fish-completion-3.0.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-3.0.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x"
        },
        "product_reference": "cosign-fish-completion-3.0.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-3.0.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64"
        },
        "product_reference": "cosign-fish-completion-3.0.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-3.0.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64"
        },
        "product_reference": "cosign-zsh-completion-3.0.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-3.0.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le"
        },
        "product_reference": "cosign-zsh-completion-3.0.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-3.0.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x"
        },
        "product_reference": "cosign-zsh-completion-3.0.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-3.0.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
        },
        "product_reference": "cosign-zsh-completion-3.0.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-22772",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-22772"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio\u0027s metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-22772",
          "url": "https://www.suse.com/security/cve/CVE-2026-22772"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256532 for CVE-2026-22772",
          "url": "https://bugzilla.suse.com/1256532"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-22772"
    },
    {
      "cve": "CVE-2026-23991",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23991"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23991",
          "url": "https://www.suse.com/security/cve/CVE-2026-23991"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257079 for CVE-2026-23991",
          "url": "https://bugzilla.suse.com/1257079"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-23991"
    },
    {
      "cve": "CVE-2026-23992",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23992"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23992",
          "url": "https://www.suse.com/security/cve/CVE-2026-23992"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257084 for CVE-2026-23992",
          "url": "https://bugzilla.suse.com/1257084"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-23992"
    },
    {
      "cve": "CVE-2026-24122",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24122"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate\u0027s \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate\u0027s validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24122",
          "url": "https://www.suse.com/security/cve/CVE-2026-24122"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258540 for CVE-2026-24122",
          "url": "https://bugzilla.suse.com/1258540"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24122"
    },
    {
      "cve": "CVE-2026-24137",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24137"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24137",
          "url": "https://www.suse.com/security/cve/CVE-2026-24137"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257137 for CVE-2026-24137",
          "url": "https://bugzilla.suse.com/1257137"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24137"
    },
    {
      "cve": "CVE-2026-26958",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26958"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26958",
          "url": "https://www.suse.com/security/cve/CVE-2026-26958"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258570 for CVE-2026-26958",
          "url": "https://bugzilla.suse.com/1258570"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.5-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-23T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-26958"
    }
  ]
}

CVE-2026-23991 (GCVE-0-2026-23991)

Vulnerability from cvelistv5 – Published: 2026-01-22 02:16 – Updated: 2026-01-22 15:35

Title

go-tuf affected by client DoS via malformed server response

Summary

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-617 - Reachable Assertion
CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

GitHub_M

References

URL

Tags

	https://github.com/theupdateframework/go-tuf/secu…	x_refsource_CONFIRM
	https://github.com/theupdateframework/go-tuf/comm…	x_refsource_MISC
	https://github.com/theupdateframework/go-tuf/rele…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	theupdateframework	go-tuf	Affected: >= 2.0.0, < 2.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T15:24:15.603757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-22T15:35:31.770Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-tuf",
          "vendor": "theupdateframework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617: Reachable Assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-22T02:17:50.311Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324"
        },
        {
          "name": "https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6"
        },
        {
          "name": "https://github.com/theupdateframework/go-tuf/releases/tag/v2.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/theupdateframework/go-tuf/releases/tag/v2.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-846p-jg2w-w324",
        "discovery": "UNKNOWN"
      },
      "title": "go-tuf affected by client DoS via malformed server response"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23991",
    "datePublished": "2026-01-22T02:16:37.294Z",
    "dateReserved": "2026-01-19T18:49:20.657Z",
    "dateUpdated": "2026-01-22T15:35:31.770Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24137 (GCVE-0-2026-24137)

Vulnerability from cvelistv5 – Published: 2026-01-23 00:04 – Updated: 2026-01-23 19:55

Title

sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

Summary

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.

Severity ?

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/sigstore/sigstore/security/adv…	x_refsource_CONFIRM
	https://github.com/sigstore/sigstore/commit/8ec41…	x_refsource_MISC
	https://github.com/sigstore/sigstore/releases/tag…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	sigstore	sigstore	Affected: < 1.10.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24137",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-23T19:55:31.439546Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-23T19:55:42.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sigstore",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.10.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-23T00:04:19.046Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sigstore/sigstore/security/advisories/GHSA-fcv2-xgw5-pqxf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sigstore/sigstore/security/advisories/GHSA-fcv2-xgw5-pqxf"
        },
        {
          "name": "https://github.com/sigstore/sigstore/commit/8ec410a2993ea78083aecf0e473a85453039496e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/sigstore/commit/8ec410a2993ea78083aecf0e473a85453039496e"
        },
        {
          "name": "https://github.com/sigstore/sigstore/releases/tag/v1.10.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/sigstore/releases/tag/v1.10.4"
        }
      ],
      "source": {
        "advisory": "GHSA-fcv2-xgw5-pqxf",
        "discovery": "UNKNOWN"
      },
      "title": "sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24137",
    "datePublished": "2026-01-23T00:04:19.046Z",
    "dateReserved": "2026-01-21T18:38:22.474Z",
    "dateUpdated": "2026-01-23T19:55:42.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22772 (GCVE-0-2026-22772)

Vulnerability from cvelistv5 – Published: 2026-01-12 20:58 – Updated: 2026-01-12 21:17

Title

Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

Summary

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.

Severity ?

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

URL

Tags

	https://github.com/sigstore/fulcio/security/advis…	x_refsource_CONFIRM
	https://github.com/sigstore/fulcio/commit/eaae2f2…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	sigstore	fulcio	Affected: < 1.8.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22772",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-12T21:17:00.818861Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-12T21:17:31.478Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fulcio",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio\u0027s metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-12T20:58:53.659Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mr"
        },
        {
          "name": "https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978d"
        }
      ],
      "source": {
        "advisory": "GHSA-59jp-pj84-45mr",
        "discovery": "UNKNOWN"
      },
      "title": "Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22772",
    "datePublished": "2026-01-12T20:58:53.659Z",
    "dateReserved": "2026-01-09T18:27:19.387Z",
    "dateUpdated": "2026-01-12T21:17:31.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-26958 (GCVE-0-2026-26958)

Vulnerability from cvelistv5 – Published: 2026-02-19 23:01 – Updated: 2026-02-20 15:39

Title

filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity

Summary

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Severity ?

1.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

CWE

CWE-665 - Improper Initialization

Assigner

GitHub_M

References

URL

Tags

	https://github.com/FiloSottile/edwards25519/secur…	x_refsource_CONFIRM
	https://github.com/FiloSottile/edwards25519/commi…	x_refsource_MISC
	https://github.com/FiloSottile/edwards25519/relea…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	FiloSottile	filippo.io/edwards25519	Affected: < 1.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26958",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-20T15:27:08.887006Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-20T15:39:04.748Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "filippo.io/edwards25519",
          "vendor": "FiloSottile",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 1.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-665",
              "description": "CWE-665: Improper Initialization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T23:01:26.923Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FiloSottile/edwards25519/security/advisories/GHSA-fw7p-63qq-7hpr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FiloSottile/edwards25519/security/advisories/GHSA-fw7p-63qq-7hpr"
        },
        {
          "name": "https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abb"
        },
        {
          "name": "https://github.com/FiloSottile/edwards25519/releases/tag/v1.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FiloSottile/edwards25519/releases/tag/v1.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-fw7p-63qq-7hpr",
        "discovery": "UNKNOWN"
      },
      "title": "filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-26958",
    "datePublished": "2026-02-19T23:01:26.923Z",
    "dateReserved": "2026-02-16T22:20:28.611Z",
    "dateUpdated": "2026-02-20T15:39:04.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23992 (GCVE-0-2026-23992)

Vulnerability from cvelistv5 – Published: 2026-01-22 02:20 – Updated: 2026-01-22 15:21

Title

go-tuf improperly validates the configured threshold for delegations

Summary

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

GitHub_M

References

URL

Tags

	https://github.com/theupdateframework/go-tuf/secu…	x_refsource_CONFIRM
	https://github.com/theupdateframework/go-tuf/comm…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	theupdateframework	go-tuf	Affected: >= 2.0.0, < 2.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T15:21:00.989880Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-22T15:21:21.301Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-tuf",
          "vendor": "theupdateframework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-22T02:20:06.845Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-fphv-w9fq-2525",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-fphv-w9fq-2525"
        },
        {
          "name": "https://github.com/theupdateframework/go-tuf/commit/b38d91fdbc69dfe31fe9230d97dafe527ea854a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/theupdateframework/go-tuf/commit/b38d91fdbc69dfe31fe9230d97dafe527ea854a0"
        }
      ],
      "source": {
        "advisory": "GHSA-fphv-w9fq-2525",
        "discovery": "UNKNOWN"
      },
      "title": "go-tuf improperly validates the configured threshold for delegations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23992",
    "datePublished": "2026-01-22T02:20:06.845Z",
    "dateReserved": "2026-01-19T18:49:20.657Z",
    "dateUpdated": "2026-01-22T15:21:21.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24122 (GCVE-0-2026-24122)

Vulnerability from cvelistv5 – Published: 2026-02-19 22:27 – Updated: 2026-02-20 15:41

Title

Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked

Summary

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.

Severity ?

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

GitHub_M

References

URL

Tags

	https://github.com/sigstore/cosign/security/advis…	x_refsource_CONFIRM
	https://github.com/sigstore/cosign/commit/3c9a736…	x_refsource_MISC
	https://github.com/sigstore/cosign/releases/tag/v3.0.5	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	sigstore	cosign	Affected: < 3.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24122",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-20T15:27:28.783661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-20T15:41:03.939Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cosign",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate\u0027s \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate\u0027s validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T22:27:08.828Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm"
        },
        {
          "name": "https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e"
        },
        {
          "name": "https://github.com/sigstore/cosign/releases/tag/v3.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/cosign/releases/tag/v3.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-wfqv-66vq-46rm",
        "discovery": "UNKNOWN"
      },
      "title": "Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24122",
    "datePublished": "2026-02-19T22:27:08.828Z",
    "dateReserved": "2026-01-21T18:38:22.473Z",
    "dateUpdated": "2026-02-20T15:41:03.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:10235-1

CVE-2026-23991 (GCVE-0-2026-23991)

CVE-2026-24137 (GCVE-0-2026-24137)

CVE-2026-22772 (GCVE-0-2026-22772)

CVE-2026-26958 (GCVE-0-2026-26958)

CVE-2026-23992 (GCVE-0-2026-23992)

CVE-2026-24122 (GCVE-0-2026-24122)

Tags

Sightings

Nomenclature