SUSE-CU-2025:5889-1: Security update of suse/cosign

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/cosign
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2025:5889-1
Container Tags        : suse/cosign:2 , suse/cosign:2.5 , suse/cosign:2.5.3 , suse/cosign:2.5.3-13.5 , suse/cosign:latest
Container Release     : 13.5
Severity              : important
Type                  : security
References            : 1246597 1246725 CVE-2025-46569 CVE-2025-6965 
-----------------------------------------------------------------

The container suse/cosign was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:2592-1
Released:    Fri Aug  1 16:43:59 2025
Summary:     Security update for cosign
Type:        security
Severity:    important
References:  1246725,CVE-2025-46569
This update for cosign fixes the following issues:

Update to version 2.5.3 (jsc#SLE-23879):

- CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego (bsc#1246725)

Changelog:

Update to 2.5.3:

- Add signing-config create command (#4280)
- Allow multiple services to be specified for trusted-root create (#4285)
- force when copying the latest image to overwrite (#4298)
- Fix cert verification logic for trusted-root/SCTs (#4294)
- Fix lint error for types package (#4295)
- feat: Add OCI 1.1+ experimental support to tree (#4205)
- Add validity period end for trusted-root create (#4271)
- avoid double-loading trustedroot from file (#4264)

Update to 2.5.2:

- Do not load trusted root when CT env key is set
- docs: improve doc for --no-upload option (#4206)

Update to 2.5.1:

- Add Rekor v2 support for trusted-root create (#4242)
- Add baseUrl and Uri to trusted-root create command
- Upgrade to TUF v2 client with trusted root
- Don't verify SCT for a private PKI cert (#4225)
- Bump TSA library to relax EKU chain validation rules (#4219)
- Bump sigstore-go to pick up log index=0 fix (#4162)
- remove unused recursive flag on attest command (#4187)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:2672-1
Released:    Mon Aug  4 15:06:13 2025
Summary:     Security update for sqlite3
Type:        security
Severity:    important
References:  1246597,CVE-2025-6965
This update for sqlite3 fixes the following issues:

- Update to version 3.50.2
- CVE-2025-6965: Fixed an integer truncation to avoid assertion faults. (bsc#1246597)
    

The following package changes have been done:

- cosign-2.5.3-150400.3.30.1 updated
- libsqlite3-0-3.50.2-150000.3.33.1 updated
- container:suse-sle15-15.7-2ff8503d8d2e2055bb38690ca06e159fd70e571b0c0109de6415e9318b59f587-0 updated
- container:registry.suse.com-bci-bci-micro-15.7-c0bbcf809c1ae4117c45543f3b3f5fd89bede788a858710201c358cafbfc5925-0 updated