SUSE-SU-2024:1486-2
- Source
- https://www.suse.com/support/update/announcement/2024/suse-su-20241486-2/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1486-2.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2024:1486-2
- Upstream
CVE (2)
- Related
- Published
- 2024-06-18T11:05:34Z
- Modified
- 2026-02-04T03:57:15Z
- Summary
- Security update for cosign
- Details
-
This update for cosign fixes the following issues:
- CVE-2024-29902: Fixed denial of service on host machine via remote image with a malicious attachments (bsc#1222835)
- CVE-2024-29903: Fixed denial of service on host machine via malicious software artifacts (bsc#1222837)
Other fixes:
- Updated to 2.2.4 (jsc#SLE-23879)
- Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
- ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
- fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
- Honor creation timestamp for signatures again (#3549)
- Features
- Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
- References
Affected packages
SUSE:Linux Enterprise Module for Basesystem 15 SP6 / cosign
Package
- Name
- cosign
- Purl
- pkg:rpm/suse/cosign&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6