Vulnerability-Lookup

OPENSUSE-SU-2026:10232-1

Vulnerability from csaf_opensuse - Published: 2026-02-20 00:00 - Updated: 2026-02-20 00:00

Summary

cosign-3.0.4-2.1 on GA media

Notes

Title of the patch

cosign-3.0.4-2.1 on GA media

Description of the patch

These are all security issues fixed in the cosign-3.0.4-2.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2026-10232

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "cosign-3.0.4-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the cosign-3.0.4-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10232",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10232-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-11065 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-11065/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58181 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-22703 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-22703/"
      }
    ],
    "title": "cosign-3.0.4-2.1 on GA media",
    "tracking": {
      "current_release_date": "2026-02-20T00:00:00Z",
      "generator": {
        "date": "2026-02-20T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10232-1",
      "initial_release_date": "2026-02-20T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-02-20T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.4-2.1.aarch64",
                "product": {
                  "name": "cosign-3.0.4-2.1.aarch64",
                  "product_id": "cosign-3.0.4-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-3.0.4-2.1.aarch64",
                "product": {
                  "name": "cosign-bash-completion-3.0.4-2.1.aarch64",
                  "product_id": "cosign-bash-completion-3.0.4-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-3.0.4-2.1.aarch64",
                "product": {
                  "name": "cosign-fish-completion-3.0.4-2.1.aarch64",
                  "product_id": "cosign-fish-completion-3.0.4-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-3.0.4-2.1.aarch64",
                "product": {
                  "name": "cosign-zsh-completion-3.0.4-2.1.aarch64",
                  "product_id": "cosign-zsh-completion-3.0.4-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.4-2.1.ppc64le",
                "product": {
                  "name": "cosign-3.0.4-2.1.ppc64le",
                  "product_id": "cosign-3.0.4-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-3.0.4-2.1.ppc64le",
                "product": {
                  "name": "cosign-bash-completion-3.0.4-2.1.ppc64le",
                  "product_id": "cosign-bash-completion-3.0.4-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-3.0.4-2.1.ppc64le",
                "product": {
                  "name": "cosign-fish-completion-3.0.4-2.1.ppc64le",
                  "product_id": "cosign-fish-completion-3.0.4-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-3.0.4-2.1.ppc64le",
                "product": {
                  "name": "cosign-zsh-completion-3.0.4-2.1.ppc64le",
                  "product_id": "cosign-zsh-completion-3.0.4-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.4-2.1.s390x",
                "product": {
                  "name": "cosign-3.0.4-2.1.s390x",
                  "product_id": "cosign-3.0.4-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-3.0.4-2.1.s390x",
                "product": {
                  "name": "cosign-bash-completion-3.0.4-2.1.s390x",
                  "product_id": "cosign-bash-completion-3.0.4-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-3.0.4-2.1.s390x",
                "product": {
                  "name": "cosign-fish-completion-3.0.4-2.1.s390x",
                  "product_id": "cosign-fish-completion-3.0.4-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-3.0.4-2.1.s390x",
                "product": {
                  "name": "cosign-zsh-completion-3.0.4-2.1.s390x",
                  "product_id": "cosign-zsh-completion-3.0.4-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.4-2.1.x86_64",
                "product": {
                  "name": "cosign-3.0.4-2.1.x86_64",
                  "product_id": "cosign-3.0.4-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-3.0.4-2.1.x86_64",
                "product": {
                  "name": "cosign-bash-completion-3.0.4-2.1.x86_64",
                  "product_id": "cosign-bash-completion-3.0.4-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-3.0.4-2.1.x86_64",
                "product": {
                  "name": "cosign-fish-completion-3.0.4-2.1.x86_64",
                  "product_id": "cosign-fish-completion-3.0.4-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-3.0.4-2.1.x86_64",
                "product": {
                  "name": "cosign-zsh-completion-3.0.4-2.1.x86_64",
                  "product_id": "cosign-zsh-completion-3.0.4-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.4-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-3.0.4-2.1.aarch64"
        },
        "product_reference": "cosign-3.0.4-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.4-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-3.0.4-2.1.ppc64le"
        },
        "product_reference": "cosign-3.0.4-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.4-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-3.0.4-2.1.s390x"
        },
        "product_reference": "cosign-3.0.4-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.4-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-3.0.4-2.1.x86_64"
        },
        "product_reference": "cosign-3.0.4-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-3.0.4-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.aarch64"
        },
        "product_reference": "cosign-bash-completion-3.0.4-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-3.0.4-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.ppc64le"
        },
        "product_reference": "cosign-bash-completion-3.0.4-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-3.0.4-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.s390x"
        },
        "product_reference": "cosign-bash-completion-3.0.4-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-3.0.4-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.x86_64"
        },
        "product_reference": "cosign-bash-completion-3.0.4-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-3.0.4-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.aarch64"
        },
        "product_reference": "cosign-fish-completion-3.0.4-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-3.0.4-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.ppc64le"
        },
        "product_reference": "cosign-fish-completion-3.0.4-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-3.0.4-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.s390x"
        },
        "product_reference": "cosign-fish-completion-3.0.4-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-3.0.4-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.x86_64"
        },
        "product_reference": "cosign-fish-completion-3.0.4-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-3.0.4-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.aarch64"
        },
        "product_reference": "cosign-zsh-completion-3.0.4-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-3.0.4-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.ppc64le"
        },
        "product_reference": "cosign-zsh-completion-3.0.4-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-3.0.4-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.s390x"
        },
        "product_reference": "cosign-zsh-completion-3.0.4-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-3.0.4-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.x86_64"
        },
        "product_reference": "cosign-zsh-completion-3.0.4-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-11065",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-11065"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-11065",
          "url": "https://www.suse.com/security/cve/CVE-2025-11065"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250608 for CVE-2025-11065",
          "url": "https://bugzilla.suse.com/1250608"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-11065"
    },
    {
      "cve": "CVE-2025-58181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58181",
          "url": "https://www.suse.com/security/cve/CVE-2025-58181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1253784 for CVE-2025-58181",
          "url": "https://bugzilla.suse.com/1253784"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58181"
    },
    {
      "cve": "CVE-2026-22703",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-22703"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact\u0027s digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact\u0027s digest, the user\u0027s public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user\u0027s identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-3.0.4-2.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-22703",
          "url": "https://www.suse.com/security/cve/CVE-2026-22703"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256496 for CVE-2026-22703",
          "url": "https://bugzilla.suse.com/1256496"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-3.0.4-2.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-3.0.4-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-22703"
    }
  ]
}

CVE-2025-11065 (GCVE-0-2025-11065)

Vulnerability from cvelistv5 – Published: 2026-01-26 19:36 – Updated: 2026-02-03 19:21

Title

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Summary

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/security/cve/CVE-2025-11065	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2391829	issue-trackingx_refsource_REDHAT
	https://github.com/go-viper/mapstructure/commit/7…
	https://github.com/go-viper/mapstructure/security…

Impacted products

Vendor

Product

Version

Affected: 0 , < 2.4.0 (semver)

Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Certification for Red Hat Enterprise Linux 8	cpe:/a:redhat:certifications:1::el8
Red Hat	Red Hat Certification Program for Red Hat Enterprise Linux 9	cpe:/a:redhat:certifications:9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat OpenShift distributed tracing 3	cpe:/a:redhat:openshift_distributed_tracing:3
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1
Red Hat	Red Hat Trusted Application Pipeline	cpe:/a:redhat:trusted_application_pipeline:1
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11065",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T19:21:11.932692Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T19:21:17.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/go-viper/mapstructure/",
          "defaultStatus": "unaffected",
          "packageName": "github.com/go-viper/mapstructure/v2",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_pipelines:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-pipelines-client",
          "product": "OpenShift Pipelines",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:acm:2"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/acm-grafana-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:acm:2"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/submariner-rhel9-operator",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-central-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-main-rhel8",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-rhel8-operator",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:certifications:1::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-certification-preflight",
          "product": "Red Hat Certification for Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:certifications:9"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-certification-preflight",
          "product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gvisor-tap-vsock",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "opentelemetry-collector",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "toolbox",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "gvisor-tap-vsock",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "opentelemetry-collector",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "toolbox",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-model-registry-rhel9",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-rhel9-operator",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "microshift",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-helm-operator",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-helm-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "affected",
          "packageName": "devspaces/traefik-rhel9",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "unaffected",
          "packageName": "devspaces/udi-base-rhel9",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "unaffected",
          "packageName": "devspaces/udi-rhel9",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/opentelemetry-collector-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/argocd-rhel8",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/argocd-rhel9",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_application_pipeline:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtap-task-runner/rhtap-task-runner-rhel9",
          "product": "Red Hat Trusted Application Pipeline",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/cosign-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/fulcio-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/gitsign-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/rekor-backfill-redis-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/rekor-cli-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/rekor-server-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/timestamp-authority-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
          ],
          "defaultStatus": "affected",
          "packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
          "product": "Zero Trust Workload Identity Manager - Tech Preview",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
          ],
          "defaultStatus": "affected",
          "packageName": "zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9",
          "product": "Zero Trust Workload Identity Manager - Tech Preview",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
          ],
          "defaultStatus": "affected",
          "packageName": "zero-trust-workload-identity-manager/spiffe-spire-server-rhel9",
          "product": "Zero Trust Workload Identity Manager - Tech Preview",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
          ],
          "defaultStatus": "affected",
          "packageName": "zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9",
          "product": "Zero Trust Workload Identity Manager - Tech Preview",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-08-29T14:52:35.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-26T19:36:28.900Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-11065"
        },
        {
          "name": "RHBZ#2391829",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391829"
        },
        {
          "url": "https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c"
        },
        {
          "url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-29T17:01:44.012814+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-08-29T14:52:35+00:00",
          "value": "Made public."
        }
      ],
      "title": "Github.com/go-viper/mapstructure/v2: go-viper\u0027s mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-209: Generation of Error Message Containing Sensitive Information"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-11065",
    "datePublished": "2026-01-26T19:36:28.900Z",
    "dateReserved": "2025-09-26T12:01:08.227Z",
    "dateUpdated": "2026-02-03T19:21:17.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-58181 (GCVE-0-2025-58181)

Vulnerability from cvelistv5 – Published: 2025-11-19 20:33 – Updated: 2025-11-20 17:14

Title

Unbounded memory consumption in golang.org/x/crypto/ssh

Summary

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-1284

Assigner

References

URL

Tags

	https://groups.google.com/g/golang-announce/c/w-o…
	https://go.dev/cl/721961
	https://go.dev/issue/76363
	https://pkg.go.dev/vuln/GO-2025-4134

Impacted products

	Vendor	Product	Version
	golang.org/x/crypto	golang.org/x/crypto/ssh	Affected: 0 , < 0.45.0 (semver)

Credits

Jakub Ciolek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-58181",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-19T20:49:06.918113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-19T20:49:26.800Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh",
          "product": "golang.org/x/crypto/ssh",
          "programRoutines": [
            {
              "name": "parseGSSAPIPayload"
            },
            {
              "name": "NewServerConn"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.45.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1284",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-20T17:14:59.856Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA"
        },
        {
          "url": "https://go.dev/cl/721961"
        },
        {
          "url": "https://go.dev/issue/76363"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-4134"
        }
      ],
      "title": "Unbounded memory consumption in golang.org/x/crypto/ssh"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-58181",
    "datePublished": "2025-11-19T20:33:42.795Z",
    "dateReserved": "2025-08-27T14:50:58.691Z",
    "dateUpdated": "2025-11-20T17:14:59.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22703 (GCVE-0-2026-22703)

Vulnerability from cvelistv5 – Published: 2026-01-10 06:11 – Updated: 2026-01-12 16:43

Title

Cosign verification accepts any valid Rekor entry under certain conditions

Summary

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact's digest, the user's public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user's identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M

References

URL

Tags

	https://github.com/sigstore/cosign/security/advis…	x_refsource_CONFIRM
	https://github.com/sigstore/cosign/pull/4623	x_refsource_MISC
	https://github.com/sigstore/cosign/commit/6832fba…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	sigstore	cosign	Affected: < 3.0.4 Affected: < 2.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22703",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-12T16:43:50.752285Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-12T16:43:57.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cosign",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.4"
            },
            {
              "status": "affected",
              "version": "\u003c 2.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact\u0027s digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact\u0027s digest, the user\u0027s public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user\u0027s identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T06:11:09.426Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m"
        },
        {
          "name": "https://github.com/sigstore/cosign/pull/4623",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/cosign/pull/4623"
        },
        {
          "name": "https://github.com/sigstore/cosign/commit/6832fba4928c1ad69400235bbc41212de5006176",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/cosign/commit/6832fba4928c1ad69400235bbc41212de5006176"
        }
      ],
      "source": {
        "advisory": "GHSA-whqx-f9j3-ch6m",
        "discovery": "UNKNOWN"
      },
      "title": "Cosign verification accepts any valid Rekor entry under certain conditions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22703",
    "datePublished": "2026-01-10T06:11:09.426Z",
    "dateReserved": "2026-01-08T19:23:09.857Z",
    "dateUpdated": "2026-01-12T16:43:57.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:10232-1

CVE-2025-11065 (GCVE-0-2025-11065)

CVE-2025-58181 (GCVE-0-2025-58181)

CVE-2026-22703 (GCVE-0-2026-22703)

Tags

Sightings

Nomenclature