Vulnerability-Lookup

CVE-2025-11065 (GCVE-0-2025-11065)

Vulnerability from cvelistv5 – Published: 2026-01-26 19:36 – Updated: 2026-06-29 23:28

Title

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Summary

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

redhat

References

4 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2025-11065	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2391829	issue-trackingx_refsource_REDHAT
https://github.com/go-viper/mapstructure/commit/7…
https://github.com/go-viper/mapstructure/security…

Impacted products

16 products

Vendor	Product	Version
		Affected: 0 , < 2.4.0 (semver)
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Certification for Red Hat Enterprise Linux 8	cpe:/a:redhat:certifications:1::el8
Red Hat	Red Hat Certification Program for Red Hat Enterprise Linux 9	cpe:/a:redhat:certifications:9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat OpenShift distributed tracing 3	cpe:/a:redhat:openshift_distributed_tracing:3
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1
Red Hat	Red Hat Trusted Application Pipeline	cpe:/a:redhat:trusted_application_pipeline:1
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0

Date Public

2025-08-29 14:52

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11065",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T19:21:11.932692Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T19:21:17.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/go-viper/mapstructure/",
          "defaultStatus": "unaffected",
          "packageName": "github.com/go-viper/mapstructure/v2",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_pipelines:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-pipelines-client",
          "product": "OpenShift Pipelines",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:acm:2"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/acm-grafana-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:acm:2"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/submariner-rhel9-operator",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-central-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-main-rhel8",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-rhel8-operator",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8",
          "product": "Red Hat Advanced Cluster Security 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:certifications:1::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-certification-preflight",
          "product": "Red Hat Certification for Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:certifications:9"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-certification-preflight",
          "product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gvisor-tap-vsock",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "opentelemetry-collector",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "toolbox",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "gvisor-tap-vsock",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "opentelemetry-collector",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "toolbox",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-model-registry-rhel9",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-rhel9-operator",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "microshift",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-helm-operator",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-helm-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "affected",
          "packageName": "devspaces/traefik-rhel9",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "unaffected",
          "packageName": "devspaces/udi-base-rhel9",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "unaffected",
          "packageName": "devspaces/udi-rhel9",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/opentelemetry-collector-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/argocd-rhel8",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/argocd-rhel9",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_application_pipeline:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtap-task-runner/rhtap-task-runner-rhel9",
          "product": "Red Hat Trusted Application Pipeline",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/cosign-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/fulcio-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/gitsign-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/rekor-backfill-redis-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/rekor-cli-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/rekor-server-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/timestamp-authority-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
          ],
          "defaultStatus": "affected",
          "packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
          "product": "Zero Trust Workload Identity Manager - Tech Preview",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
          ],
          "defaultStatus": "affected",
          "packageName": "zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9",
          "product": "Zero Trust Workload Identity Manager - Tech Preview",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
          ],
          "defaultStatus": "affected",
          "packageName": "zero-trust-workload-identity-manager/spiffe-spire-server-rhel9",
          "product": "Zero Trust Workload Identity Manager - Tech Preview",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
          ],
          "defaultStatus": "affected",
          "packageName": "zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9",
          "product": "Zero Trust Workload Identity Manager - Tech Preview",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-08-29T14:52:35.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T23:28:27.767Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-11065"
        },
        {
          "name": "RHBZ#2391829",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391829"
        },
        {
          "url": "https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c"
        },
        {
          "url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-29T17:01:44.012Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-08-29T14:52:35.000Z",
          "value": "Made public."
        }
      ],
      "title": "Github.com/go-viper/mapstructure/v2: go-viper\u0027s mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-209: Generation of Error Message Containing Sensitive Information"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-11065",
    "datePublished": "2026-01-26T19:36:28.900Z",
    "dateReserved": "2025-09-26T12:01:08.227Z",
    "dateUpdated": "2026-06-29T23:28:27.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-11065",
      "date": "2026-06-30",
      "epss": "0.00357",
      "percentile": "0.27585"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-11065\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-01-26T20:16:06.840\",\"lastModified\":\"2026-06-30T00:16:51.197\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 una falla en github.com/go-viper/mapstructure/v2, en el componente de procesamiento de campos que utiliza mapstructure.WeakDecode. Esta vulnerabilidad permite la revelaci\u00f3n de informaci\u00f3n a trav\u00e9s de mensajes de error detallados que pueden filtrar valores de entrada sensibles a trav\u00e9s de datos malformados proporcionados por el usuario procesados en contextos cr\u00edticos para la seguridad.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com/go-viper/mapstructure/\",\"packageName\":\"github.com/go-viper/mapstructure/v2\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"2.4.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Pipelines\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-pipelines-client\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/acm-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/submariner-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"advanced-cluster-security/rhacs-central-db-rhel8\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"advanced-cluster-security/rhacs-main-rhel8\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"advanced-cluster-security/rhacs-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"advanced-cluster-security/rhacs-roxctl-rhel8\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"advanced-cluster-security/rhacs-scanner-v4-db-rhel8\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"advanced-cluster-security/rhacs-scanner-v4-rhel8\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Certification for Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"redhat-certification-preflight\",\"cpes\":[\"cpe:/a:redhat:certifications:1::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Certification Program for Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"redhat-certification-preflight\",\"cpes\":[\"cpe:/a:redhat:certifications:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gvisor-tap-vsock\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"opentelemetry-collector\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"toolbox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gvisor-tap-vsock\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"opentelemetry-collector\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"toolbox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-model-registry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"microshift\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-helm-operator\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-helm-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"podman\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devspaces/traefik-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devspaces/udi-base-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devspaces/udi-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift distributed tracing 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosdt/opentelemetry-collector-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_distributed_tracing:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-gitops-1/argocd-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-gitops-1/argocd-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Application Pipeline\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtap-task-runner/rhtap-task-runner-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_application_pipeline:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtas/cosign-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtas/fulcio-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtas/gitsign-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtas/rekor-backfill-redis-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtas/rekor-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtas/rekor-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtas/timestamp-authority-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager - Tech Preview\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager - Tech Preview\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager - Tech Preview\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"zero-trust-workload-identity-manager/spiffe-spire-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager - Tech Preview\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-02-03T19:21:11.932692Z\",\"id\":\"CVE-2025-11065\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2025-11065\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2391829\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-11065\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-03T19:21:11.932692Z\"}}}], \"references\": [{\"url\": \"https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-03T19:21:05.294Z\"}}], \"cna\": {\"title\": \"Github.com/go-viper/mapstructure/v2: go-viper\u0027s mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.4.0\", \"versionType\": \"semver\"}], \"packageName\": \"github.com/go-viper/mapstructure/v2\", \"collectionURL\": \"https://github.com/go-viper/mapstructure/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Pipelines\", \"packageName\": \"openshift-pipelines-client\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/acm-grafana-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/submariner-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security 4\", \"packageName\": \"advanced-cluster-security/rhacs-central-db-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security 4\", \"packageName\": \"advanced-cluster-security/rhacs-main-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security 4\", \"packageName\": \"advanced-cluster-security/rhacs-rhel8-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security 4\", \"packageName\": \"advanced-cluster-security/rhacs-roxctl-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security 4\", \"packageName\": \"advanced-cluster-security/rhacs-scanner-v4-db-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security 4\", \"packageName\": \"advanced-cluster-security/rhacs-scanner-v4-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:certifications:1::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Certification for Red Hat Enterprise Linux 8\", \"packageName\": \"redhat-certification-preflight\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:certifications:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Certification Program for Red Hat Enterprise Linux 9\", \"packageName\": \"redhat-certification-preflight\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"gvisor-tap-vsock\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"opentelemetry-collector\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"toolbox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"gvisor-tap-vsock\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"opentelemetry-collector\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"toolbox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-model-registry-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"microshift\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-helm-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-helm-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"podman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/traefik-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/udi-base-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/udi-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_distributed_tracing:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift distributed tracing 3\", \"packageName\": \"rhosdt/opentelemetry-collector-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps\", \"packageName\": \"openshift-gitops-1/argocd-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps\", \"packageName\": \"openshift-gitops-1/argocd-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_application_pipeline:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Application Pipeline\", \"packageName\": \"rhtap-task-runner/rhtap-task-runner-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"packageName\": \"rhtas/cosign-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"packageName\": \"rhtas/fulcio-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"packageName\": \"rhtas/gitsign-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"packageName\": \"rhtas/rekor-backfill-redis-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"packageName\": \"rhtas/rekor-cli-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"packageName\": \"rhtas/rekor-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"packageName\": \"rhtas/timestamp-authority-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\", \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\", \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\", \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\", \"packageName\": \"zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-08-29T17:01:44.012Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2025-08-29T14:52:35.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2025-08-29T14:52:35.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2025-11065\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2391829\", \"name\": \"RHBZ#2391829\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c\"}, {\"url\": \"https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-209\", \"description\": \"Generation of Error Message Containing Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-06-29T23:28:27.767Z\"}, \"x_redhatCweChain\": \"CWE-209: Generation of Error Message Containing Sensitive Information\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-11065\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-29T23:28:27.767Z\", \"dateReserved\": \"2025-09-26T12:01:08.227Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-01-26T19:36:28.900Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

SUSE-SU-2026:20904-1

Vulnerability from csaf_suse - Published: 2026-03-18 11:27 - Updated: 2026-03-18 11:27

Summary

Security update for cosign

Severity

Moderate

Notes

Title of the patch: Security update for cosign

Description of the patch: This update for cosign fixes the following issues: Update to version 3.0.5: - CVE-2026-24122: Fixed improper validation of certificates that outlive expired CA certificates (bsc#1258542) - CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258612) - CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257139) - CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256562) - CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned by TUF repository (bsc#1257080) - CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a compromised or misconfigured TUF repository (bsc#1257085) - CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620) - CVE-2026-22703: Fixed that cosign verification accepts any valid Rekor entry under certain conditions (bsc#1256496) - CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253913)

Patchnames: SUSE-SLES-16.0-404

CVE-2025-11065

4.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-58181

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-22703

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-22772

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-23991

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-23992

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-24122

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-24137

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-26958

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

40 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1250620	self
https://bugzilla.suse.com/1253913	self
https://bugzilla.suse.com/1256496	self
https://bugzilla.suse.com/1256562	self
https://bugzilla.suse.com/1257080	self
https://bugzilla.suse.com/1257085	self
https://bugzilla.suse.com/1257139	self
https://bugzilla.suse.com/1258542	self
https://bugzilla.suse.com/1258612	self
https://www.suse.com/security/cve/CVE-2025-11065/	self
https://www.suse.com/security/cve/CVE-2025-58181/	self
https://www.suse.com/security/cve/CVE-2026-22703/	self
https://www.suse.com/security/cve/CVE-2026-22772/	self
https://www.suse.com/security/cve/CVE-2026-23991/	self
https://www.suse.com/security/cve/CVE-2026-23992/	self
https://www.suse.com/security/cve/CVE-2026-24122/	self
https://www.suse.com/security/cve/CVE-2026-24137/	self
https://www.suse.com/security/cve/CVE-2026-26958/	self
https://www.suse.com/security/cve/CVE-2025-11065	external
https://bugzilla.suse.com/1250608	external
https://www.suse.com/security/cve/CVE-2025-58181	external
https://bugzilla.suse.com/1253784	external
https://www.suse.com/security/cve/CVE-2026-22703	external
https://bugzilla.suse.com/1256496	external
https://www.suse.com/security/cve/CVE-2026-22772	external
https://bugzilla.suse.com/1256532	external
https://www.suse.com/security/cve/CVE-2026-23991	external
https://bugzilla.suse.com/1257079	external
https://www.suse.com/security/cve/CVE-2026-23992	external
https://bugzilla.suse.com/1257084	external
https://www.suse.com/security/cve/CVE-2026-24122	external
https://bugzilla.suse.com/1258540	external
https://www.suse.com/security/cve/CVE-2026-24137	external
https://bugzilla.suse.com/1257137	external
https://www.suse.com/security/cve/CVE-2026-26958	external
https://bugzilla.suse.com/1258570	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for cosign",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for cosign fixes the following issues:\n\nUpdate to version 3.0.5:\n\n- CVE-2026-24122: Fixed improper validation of certificates that outlive\n  expired CA certificates (bsc#1258542)\n- CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize receiver\n  in MultiScalarMult can produce invalid results and lead to undefined behavior\n  (bsc#1258612)\n- CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy TUF client\n  allows for arbitrary file writes with target cache path traversal\n  (bsc#1257139)\n- CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer URL\n  validation bypass can trigger SSRF to arbitrary internal services\n  (bsc#1256562)\n- CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial of\n  service due to invalid TUF metadata JSON returned by TUF repository\n  (bsc#1257080)\n- CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2: unauthorized\n  modification to TUF metadata files due to a compromised or misconfigured TUF\n  repository (bsc#1257085)\n- CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive\n  Information leak in logs (bsc#1250620)\n- CVE-2026-22703: Fixed that cosign verification accepts any valid Rekor entry\n  under certain conditions (bsc#1256496)\n- CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number of\n  mechanisms can cause unbounded memory consumption (bsc#1253913)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-404",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20904-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20904-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620904-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20904-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025109.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1250620",
        "url": "https://bugzilla.suse.com/1250620"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1253913",
        "url": "https://bugzilla.suse.com/1253913"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256496",
        "url": "https://bugzilla.suse.com/1256496"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256562",
        "url": "https://bugzilla.suse.com/1256562"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257080",
        "url": "https://bugzilla.suse.com/1257080"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257085",
        "url": "https://bugzilla.suse.com/1257085"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257139",
        "url": "https://bugzilla.suse.com/1257139"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258542",
        "url": "https://bugzilla.suse.com/1258542"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258612",
        "url": "https://bugzilla.suse.com/1258612"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-11065 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-11065/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58181 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-22703 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-22703/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-22772 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-22772/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23991 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23991/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23992 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23992/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24122 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24122/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24137 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24137/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26958 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26958/"
      }
    ],
    "title": "Security update for cosign",
    "tracking": {
      "current_release_date": "2026-03-18T11:27:44Z",
      "generator": {
        "date": "2026-03-18T11:27:44Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20904-1",
      "initial_release_date": "2026-03-18T11:27:44Z",
      "revision_history": [
        {
          "date": "2026-03-18T11:27:44Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-160000.1.1.aarch64",
                "product": {
                  "name": "cosign-3.0.5-160000.1.1.aarch64",
                  "product_id": "cosign-3.0.5-160000.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-160000.1.1.ppc64le",
                "product": {
                  "name": "cosign-3.0.5-160000.1.1.ppc64le",
                  "product_id": "cosign-3.0.5-160000.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-160000.1.1.s390x",
                "product": {
                  "name": "cosign-3.0.5-160000.1.1.s390x",
                  "product_id": "cosign-3.0.5-160000.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-3.0.5-160000.1.1.x86_64",
                "product": {
                  "name": "cosign-3.0.5-160000.1.1.x86_64",
                  "product_id": "cosign-3.0.5-160000.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64"
        },
        "product_reference": "cosign-3.0.5-160000.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le"
        },
        "product_reference": "cosign-3.0.5-160000.1.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x"
        },
        "product_reference": "cosign-3.0.5-160000.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64"
        },
        "product_reference": "cosign-3.0.5-160000.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64"
        },
        "product_reference": "cosign-3.0.5-160000.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le"
        },
        "product_reference": "cosign-3.0.5-160000.1.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x"
        },
        "product_reference": "cosign-3.0.5-160000.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-3.0.5-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
        },
        "product_reference": "cosign-3.0.5-160000.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-11065",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-11065"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-11065",
          "url": "https://www.suse.com/security/cve/CVE-2025-11065"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250608 for CVE-2025-11065",
          "url": "https://bugzilla.suse.com/1250608"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T11:27:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-11065"
    },
    {
      "cve": "CVE-2025-58181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58181",
          "url": "https://www.suse.com/security/cve/CVE-2025-58181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1253784 for CVE-2025-58181",
          "url": "https://bugzilla.suse.com/1253784"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T11:27:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58181"
    },
    {
      "cve": "CVE-2026-22703",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-22703"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact\u0027s digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact\u0027s digest, the user\u0027s public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user\u0027s identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-22703",
          "url": "https://www.suse.com/security/cve/CVE-2026-22703"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256496 for CVE-2026-22703",
          "url": "https://bugzilla.suse.com/1256496"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T11:27:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-22703"
    },
    {
      "cve": "CVE-2026-22772",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-22772"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio\u0027s metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-22772",
          "url": "https://www.suse.com/security/cve/CVE-2026-22772"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256532 for CVE-2026-22772",
          "url": "https://bugzilla.suse.com/1256532"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T11:27:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-22772"
    },
    {
      "cve": "CVE-2026-23991",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23991"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23991",
          "url": "https://www.suse.com/security/cve/CVE-2026-23991"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257079 for CVE-2026-23991",
          "url": "https://bugzilla.suse.com/1257079"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T11:27:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-23991"
    },
    {
      "cve": "CVE-2026-23992",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23992"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23992",
          "url": "https://www.suse.com/security/cve/CVE-2026-23992"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257084 for CVE-2026-23992",
          "url": "https://bugzilla.suse.com/1257084"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T11:27:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-23992"
    },
    {
      "cve": "CVE-2026-24122",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24122"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate\u0027s \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate\u0027s validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24122",
          "url": "https://www.suse.com/security/cve/CVE-2026-24122"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258540 for CVE-2026-24122",
          "url": "https://bugzilla.suse.com/1258540"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T11:27:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24122"
    },
    {
      "cve": "CVE-2026-24137",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24137"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24137",
          "url": "https://www.suse.com/security/cve/CVE-2026-24137"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257137 for CVE-2026-24137",
          "url": "https://bugzilla.suse.com/1257137"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T11:27:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24137"
    },
    {
      "cve": "CVE-2026-26958",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26958"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26958",
          "url": "https://www.suse.com/security/cve/CVE-2026-26958"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258570 for CVE-2026-26958",
          "url": "https://bugzilla.suse.com/1258570"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:cosign-3.0.5-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:cosign-3.0.5-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T11:27:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-26958"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-11065 (GCVE-0-2025-11065)

SUSE-SU-2026:20904-1

Tags

Sightings

Nomenclature