< back to search

shield Security update for cosign
SUSE-SLE-Module-Basesystem-15-SP7-2026-2365

This update for cosign fixes the following issue - CVE-2026-39395: Incorrect attestation verification due to malformed payloads or mismatched predicate types (bsc#1261859). Changes for cosign: - update to 3.0.6: * Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801) * Handle whitespace-only certificate annotation (#4760) * fix(sign): closing SignerVerifier too early when signing with a security key (#4761) * Disallow --new-bundle-format and --rfc3161-timestamp (#4762) * support managed keys in conformance testing (#4728) * Add support for GCE metadata server env var (#4732) * fix: preserve per-layer annotations in WriteAttestationsReferrer (#4709) * Fix parsing of in-toto for string predicates * Mark batch of flags for deprecation (#4698) * disallow key and cert identity being used together during verification (#4636) * support key creation in GitLab group (#4704) - Set CGO_ENABLED=1 for fixing s390x failed build - build against a maintained golang version (upstream uses go1.20)

  • Release Date
    Jun 11 2026
  • References
    Bugzilla: 1261859
    CVEs: CVE-2026-39395
  • Type
    security
  • Severity
    moderate

cloud_download Downloads

Basesystem Module 15.7 ppc64le
  • Packages
    cosign
    Container Signing, Verification and Storage in an OCI registry
    3.0.6-150400.3.42.1 lock rpm lock src
    cosign-bash-completion
    Bash Completion for cosign
    3.0.6-150400.3.42.1 lock rpm
    cosign-zsh-completion
    Zsh Completion for cosign
    3.0.6-150400.3.42.1 lock rpm
Basesystem Module 15.7 aarch64
  • Packages
    cosign
    Container Signing, Verification and Storage in an OCI registry
    3.0.6-150400.3.42.1 lock rpm lock src
    cosign-bash-completion
    Bash Completion for cosign
    3.0.6-150400.3.42.1 lock rpm
    cosign-zsh-completion
    Zsh Completion for cosign
    3.0.6-150400.3.42.1 lock rpm
Basesystem Module 15.7 s390x
  • Packages
    cosign
    Container Signing, Verification and Storage in an OCI registry
    3.0.6-150400.3.42.1 lock rpm lock src
    cosign-bash-completion
    Bash Completion for cosign
    3.0.6-150400.3.42.1 lock rpm
    cosign-zsh-completion
    Zsh Completion for cosign
    3.0.6-150400.3.42.1 lock rpm
Basesystem Module 15.7 x86_64
  • Packages
    cosign
    Container Signing, Verification and Storage in an OCI registry
    3.0.6-150400.3.42.1 lock rpm lock src
    cosign-bash-completion
    Bash Completion for cosign
    3.0.6-150400.3.42.1 lock rpm
    cosign-zsh-completion
    Zsh Completion for cosign
    3.0.6-150400.3.42.1 lock rpm