{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for cosign",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for cosign fixes the following issues:\n\nUpdate to version 3.0.5 (jsc#SLE-23879).\n\nSecurity issues fixed:  \n\n- CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253913).\n- CVE-2026-22703: Verification accepts any valid Rekor entry under certain conditions (bsc#1256496).\n- CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary\n  internal services (bsc#1256562).\n- CVE-2026-23991: github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned\n  by TUF repository (bsc#1257080).\n- CVE-2026-23992: github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a\n  compromised or misconfigured TUF repository (bsc#1257085).\n- CVE-2026-24122: improper validation of certificates that outlive expired CA certificates (bsc#1258542).\n- CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target\n  cache path traversal (bsc#1257139).\n- CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results\n  and lead to undefined behavior (bsc#1258612).\n\nOther updates and bugfixes:\n\n* chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)\n* chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)\n* chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)\n* chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)\n* chore(deps): bump the actions group with 3 updates (#4703)\n* update golang builder to use go1.25.7 (#4687)\n* update golangci-lint to v2.8.x (#4688)\n* Support DSSE signing conformance test (#4685)\n* chore(deps): bump the actions group across 1 directory with 8 updates (#4689)\n* Deprecate rekor-entry-type flag (#4691)\n* Deprecate cosign triangulate (#4676)\n* Deprecate cosign copy (#4681)\n* Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)\n* chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)\n* chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)\n* Automatically require signed timestamp with Rekor v2 entries (#4666)\n* Fix syntax issue in conformance test, update nightly (#4664)\n* Add mTLS support for TSA client connections when signing with a signing config (#4620)\n* fix: avoid panic on malformed tlog entry body (#4652)\n* Verify validity of chain rather than just certificate (#4663)\n* Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)\n* chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)\n* Bump sigstore/sigstore to resolve GHSA (#4660)\n* Gracefully fail if bundle payload body is not a string (#4648)\n* fix: avoid panic on malformed replace payload (#4653)\n* chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)\n* fix: avoid panic on malformed attestation payload (#4651)\n* fix: avoid panic on malformed tlog entries (#4649)\n* Update conformance to latest\n* docs(cosign): clarify RFC3161 revocation semantics (#4642)\n* Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)\n* chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)\n* Add origin key for ctfe trusted root\n* Add changelog updates for v3.0.4 and v2.6.2 (#4625)\n  \n- Update to version 3.0.4:\n  \n* Fix bundle verify path for old bundle/trusted root (#4623)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)\n* chore(deps): bump cuelang.org/go in the gomod group (#4615)\n* Optimize cosign tree performance by caching digest resolution (#4612)\n* Don\u0027t require a trusted root to verify offline with a key (#4613)\n* Support default services for trusted-root and signing-config creation (#4592)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)\n* chore(deps): bump github.com/sigstore/sigstore-go (#4578)\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)\n* chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)\n* chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)\n* chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)\n* chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)\n* chore(deps): bump the gomod group with 5 updates (#4599)\n* chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)\n* chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)\n* chore(deps): bump the actions group with 3 updates (#4587)\n* chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)\n* chore(deps): bump the gomod group with 9 updates (#4577)\n  \n- Update to version 3.0.3:\n  \n* 4554: Closes 4554 - Add warning when --output* is used (#4556)\n* chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)\n* chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)\n* chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)\n* chore(deps): bump the actions group with 4 updates (#4544)\n* chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)\n* chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)\n* update builder to use go1.25.5 (#4566)\n* Protobuf bundle support for subcommand `clean` (#4539)\n* Add staging flag to initialize with staging TUF metadata\n* update slack invite link (#4560)\n* Updating sign-blob to also support signing with a certificate (#4547)\n* Bump sigstore library dependencies (#4532)\n* Protobuf bundle support for subcommands `save` and `load` (#4538)\n* Fix cert attachment for new bundle with signing config\n* Fix OCI verification with local cert - old bundle\n* chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)\n* chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)\n* chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)\n* update go builder and cosign (#4529)\n* chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)\n* chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)\n* chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)\n* chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)\n* chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)\n* chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)\n* chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)\n* chore(deps): bump the actions group across 1 directory with 2 updates (#4516)\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)\n* chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)\n* Deprecate tlog-upload flag (#4458)\n* fix: Use signal context for `sign` cli package.\n* update offline verification directions (#4526)\n* Fix signing/verifying annotations for new bundle\n* Add support to download and attach for protobuf bundles (#4477)\n* Add --signing-algorithm flag (#3497)\n* Refactor signcommon bundle helpers\n* Add --bundle and fix --upload for new bundle\n* Pass insecure registry flags through to referrers\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)\n* Add protobuf bundle support for tree subcommand (#4491)\n* Remove stale embed import (#4492)\n* Support multiple container identities\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)\n* chore(deps): bump chainguard-dev/actions in the actions group (#4480)\n* chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)\n* chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)\n* chore(deps): bump cuelang.org/go in the gomod group (#4479)\n* upgrade OSS-Fuzz build tooling (#4487)\n* Fix segfault when no attestations are found (#4472)\n* Use overridden repository for new bundle format (#4473)\n* update go to 1.25.3 (#4471)\n* Remove --out flag from `cosign initialize` (#4462)\n* chore(deps): bump the actions group with 2 updates (#4460)\n* Deprecate offline flag (#4457)\n* Deduplicate code in sign/attest* and verify* commands (#4449)\n* Cache signing config when calling initialize (#4456)\n* Update changelog for v3.0.2 (#4455)\n* chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go\n* chore(deps): bump the actions group with 3 updates\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0\n* choose different signature filename for KMS-signed release signatures (#4448)\n* chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)\n* Update rekor-tiles version path\n* update CL for v3.0.1 release (#4447)\n* update goreleaser config for v3.0.0 release (#4446)\n* Create changelog for v3.0.0 (#4440)\n* Fetch service URLs from the TUF PGI signing config by default (#4428)\n* Create changelog for v2.6.1 (#4439)\n* chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)\n* chore(deps): bump the gomod group with 2 updates (#4429)\n* chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)\n* chore(deps): bump the actions group with 3 updates (#4434)\n* chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)\n* chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)\n* Bump module version to v3 for Cosign v3.0 (#4427)\n* Move sigstore-conformance back to tagged release (#4425)\n* Bump sigstore-go to v1.1.3 (#4423)\n* Partially populate the output of cosign verify when working with new bundles (#4416)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)\n* chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)\n* chore(deps): bump chainguard-dev/actions in the actions group (#4421)\n* bump go builder to use 1.25.1 and cosign (#4417)\n* Bump sigstore-go for more precise user agents (#4413)\n* chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)\n* chore(deps): bump the actions group with 2 updates (#4407)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)\n* Default to using the new protobuf format (#4318)\n  \n- Update to version 2.6.0:\n  \n* Require exclusively a SigningConfig or service URLs when signing (#4403)\n* Add a terminal spinner while signing with sigstore-go (#4402)\n* Bump sigstore-go, support alternative hash algorithms with keys (#4386)\n* Add support for SigningConfig in sign/attest (#4371)\n* Support self-managed keys when signing with sigstore-go (#4368)\n* Remove SHA256 assumption in sign-blob/verify-blob (#4050)\n* introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)\n* refactor: extract function to write referrer attestations (#4357)\n* Break import cycle with e2e build tag (#4370)\n* Update conformance test binary for signing config (#4367)\n* update builder image to use go1.25 (#4366)\n* Don\u0027t load content from TUF if trusted root path is specified (#4347)\n* Don\u0027t require timestamps when verifying with a key (#4337)\n* Fixes to cosign sign / verify for the new bundle format (#4346)\n* update builder to use go1.24.6 (#4334)\n* bump golangci-lint to v2.3.x (#4333)\n* Have cosign sign support bundle format (#4316)\n* Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)\n* Verify subject with bundle only when checking claims (#4320)\n* Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the\n  ability to verify with just a digest (#4306)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-777,SUSE-SLE-Module-Basesystem-15-SP7-2026-777,openSUSE-SLE-15.6-2026-777",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0777-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0777-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260777-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0777-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024541.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1250620",
        "url": "https://bugzilla.suse.com/1250620"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1253913",
        "url": "https://bugzilla.suse.com/1253913"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256496",
        "url": "https://bugzilla.suse.com/1256496"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256562",
        "url": "https://bugzilla.suse.com/1256562"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257080",
        "url": "https://bugzilla.suse.com/1257080"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257085",
        "url": "https://bugzilla.suse.com/1257085"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257139",
        "url": "https://bugzilla.suse.com/1257139"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258542",
        "url": "https://bugzilla.suse.com/1258542"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258612",
        "url": "https://bugzilla.suse.com/1258612"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-11065 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-11065/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58181 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-22703 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-22703/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-22772 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-22772/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23991 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23991/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23992 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23992/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24122 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24122/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24137 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24137/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26958 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26958/"
      }
    ],
    "title": "Security update for cosign",
    "tracking": {
      "current_release_date": "2026-03-03T13:22:27Z",
      "generator": {
        "date": "2026-03-03T13:22:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0777-1",
      "initial_release_date": "2026-03-03T13:22:27Z",
      "revision_history": [
        {
          "date": "2026-03-03T13:22:27Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-150400.3.35.1.aarch64",
                "product": {
                  "name": "cosign-3.0.5-150400.3.35.1.aarch64",
                  "product_id": "cosign-3.0.5-150400.3.35.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-150400.3.35.1.i586",
                "product": {
                  "name": "cosign-3.0.5-150400.3.35.1.i586",
                  "product_id": "cosign-3.0.5-150400.3.35.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
                "product": {
                  "name": "cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
                  "product_id": "cosign-bash-completion-3.0.5-150400.3.35.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-3.0.5-150400.3.35.1.noarch",
                "product": {
                  "name": "cosign-fish-completion-3.0.5-150400.3.35.1.noarch",
                  "product_id": "cosign-fish-completion-3.0.5-150400.3.35.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
                "product": {
                  "name": "cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
                  "product_id": "cosign-zsh-completion-3.0.5-150400.3.35.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-150400.3.35.1.ppc64le",
                "product": {
                  "name": "cosign-3.0.5-150400.3.35.1.ppc64le",
                  "product_id": "cosign-3.0.5-150400.3.35.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-150400.3.35.1.s390x",
                "product": {
                  "name": "cosign-3.0.5-150400.3.35.1.s390x",
                  "product_id": "cosign-3.0.5-150400.3.35.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-150400.3.35.1.x86_64",
                "product": {
                  "name": "cosign-3.0.5-150400.3.35.1.x86_64",
                  "product_id": "cosign-3.0.5-150400.3.35.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-150400.3.35.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64"
        },
        "product_reference": "cosign-3.0.5-150400.3.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-150400.3.35.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le"
        },
        "product_reference": "cosign-3.0.5-150400.3.35.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-150400.3.35.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x"
        },
        "product_reference": "cosign-3.0.5-150400.3.35.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-150400.3.35.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64"
        },
        "product_reference": "cosign-3.0.5-150400.3.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-3.0.5-150400.3.35.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch"
        },
        "product_reference": "cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-3.0.5-150400.3.35.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch"
        },
        "product_reference": "cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-150400.3.35.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64"
        },
        "product_reference": "cosign-3.0.5-150400.3.35.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-150400.3.35.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le"
        },
        "product_reference": "cosign-3.0.5-150400.3.35.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-150400.3.35.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x"
        },
        "product_reference": "cosign-3.0.5-150400.3.35.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-150400.3.35.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
        },
        "product_reference": "cosign-3.0.5-150400.3.35.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-11065",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-11065"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-11065",
          "url": "https://www.suse.com/security/cve/CVE-2025-11065"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250608 for CVE-2025-11065",
          "url": "https://bugzilla.suse.com/1250608"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-03T13:22:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-11065"
    },
    {
      "cve": "CVE-2025-58181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58181",
          "url": "https://www.suse.com/security/cve/CVE-2025-58181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1253784 for CVE-2025-58181",
          "url": "https://bugzilla.suse.com/1253784"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-03T13:22:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58181"
    },
    {
      "cve": "CVE-2026-22703",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-22703"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact\u0027s digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact\u0027s digest, the user\u0027s public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user\u0027s identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-22703",
          "url": "https://www.suse.com/security/cve/CVE-2026-22703"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256496 for CVE-2026-22703",
          "url": "https://bugzilla.suse.com/1256496"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-03T13:22:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-22703"
    },
    {
      "cve": "CVE-2026-22772",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-22772"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio\u0027s metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-22772",
          "url": "https://www.suse.com/security/cve/CVE-2026-22772"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256532 for CVE-2026-22772",
          "url": "https://bugzilla.suse.com/1256532"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-03T13:22:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-22772"
    },
    {
      "cve": "CVE-2026-23991",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23991"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23991",
          "url": "https://www.suse.com/security/cve/CVE-2026-23991"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257079 for CVE-2026-23991",
          "url": "https://bugzilla.suse.com/1257079"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-03T13:22:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-23991"
    },
    {
      "cve": "CVE-2026-23992",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23992"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23992",
          "url": "https://www.suse.com/security/cve/CVE-2026-23992"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257084 for CVE-2026-23992",
          "url": "https://bugzilla.suse.com/1257084"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-03T13:22:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-23992"
    },
    {
      "cve": "CVE-2026-24122",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24122"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate\u0027s \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate\u0027s validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24122",
          "url": "https://www.suse.com/security/cve/CVE-2026-24122"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258540 for CVE-2026-24122",
          "url": "https://bugzilla.suse.com/1258540"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-03T13:22:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24122"
    },
    {
      "cve": "CVE-2026-24137",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24137"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24137",
          "url": "https://www.suse.com/security/cve/CVE-2026-24137"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257137 for CVE-2026-24137",
          "url": "https://bugzilla.suse.com/1257137"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-03T13:22:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24137"
    },
    {
      "cve": "CVE-2026-26958",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26958"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
          "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26958",
          "url": "https://www.suse.com/security/cve/CVE-2026-26958"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258570 for CVE-2026-26958",
          "url": "https://bugzilla.suse.com/1258570"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-3.0.5-150400.3.35.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion-3.0.5-150400.3.35.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion-3.0.5-150400.3.35.1.noarch",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.aarch64",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.ppc64le",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.s390x",
            "openSUSE Leap 15.6:cosign-3.0.5-150400.3.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-03T13:22:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-26958"
    }
  ]
}