SUSE-SU-2023:4870-1: moderate: Security update for cosign
null at suse.de
null at suse.de
Thu Dec 14 16:30:20 UTC 2023
# Security update for cosign
Announcement ID: SUSE-SU-2023:4870-1
Rating: moderate
References:
* bsc#1216933
* jsc#SLE-23879
Cross-References:
* CVE-2023-46737
CVSS scores:
* CVE-2023-46737 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2023-46737 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products:
* Basesystem Module 15-SP4
* Basesystem Module 15-SP5
* openSUSE Leap 15.4
* openSUSE Leap 15.5
* SUSE Linux Enterprise Desktop 15 SP4
* SUSE Linux Enterprise Desktop 15 SP5
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Real Time 15 SP4
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Manager Proxy 4.3
* SUSE Manager Retail Branch Server 4.3
* SUSE Manager Server 4.3
An update that solves one vulnerability and contains one feature can now be
installed.
## Description:
This update for cosign fixes the following issues:
Updated to 2.2.1 (jsc#SLE-23879)
* Enhancements:
* CVE-2023-46737: Possible endless data attack from attacker-controlled
registry (bsc#1216933)
* feat: Support basic auth and bearer auth login to registry (#3310)
* add support for ignoring certificates with pkcs11 (#3334)
* Support ReplaceOp in Signatures (#3315)
* feat: added ability to get image digest back via triangulate (#3255)
* feat: add `--only` flag in `cosign copy` to copy sign, att & sbom (#3247)
* feat: add support attaching a Rekor bundle to a container (#3246)
* feat: add support outputting rekor response on signing (#3248)
* feat: improve dockerfile verify subcommand (#3264)
* Add guard flag for experimental OCI 1.1 verify. (#3272)
* Deprecate SBOM attachments (#3256)
* feat: dedent line in cosign copy doc (#3244)
* feat: add platform flag to cosign copy command (#3234)
* Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
* attest: pass OCI remote opts to att resolver. (#3225)
* Bug Fixes:
* Merge pull request from GHSA-vfp6-jrw2-99g9
* fix: allow cosign download sbom when image is absent (#3245)
* ci: add a OCI registry test for referrers support (#3253)
* Fix ReplaceSignatures (#3292)
* Stop using deprecated in_toto.ProvenanceStatement (#3243)
* Fixes #3236, disable SCT checking for a cosign verification when using ..
(#3237)
* fix: update error in `SignedEntity` to be more descriptive (#3233)
* Fail timestamp verification if no root is provided (#3224)
* Documentation:
* Add some docs about verifying in an air-gapped environment (#3321)
* Update CONTRIBUTING.md (#3268)
* docs: improves the Contribution guidelines (#3257)
* Remove security policy (#3230)
* Others:
* Set go to min 1.21 and update dependencies (#3327)
* Update contact for code of conduct (#3266)
* Update .ko.yaml (#3240)
Updated to 2.2.0 (jsc#SLE-23879)
* Enhancements
* switch to uploading DSSE types to rekor instead of intoto (#3113)
* add 'cosign sign' command-line parameters for mTLS (#3052)
* improve error messages around bundle != payload hash (#3146)
* make VerifyImageAttestation function public (#3156)
* Switch to cryptoutils function for SANS (#3185)
* Handle HTTP_1_1_REQUIRED errors in github provider (#3172)
* Bug Fixes
* Fix nondeterminsitic timestamps (#3121)
* Documentation
* doc: Add example of sign-blob with key in env var (#3152)
* add deprecation notice for cosign-releases GCS bucket (#3148)
* update doc links (#3186)
Updated to 2.1.1 (jsc#SLE-23879)
* Bug Fixes
* wait for the workers become available again to continue the execution
(#3084)
* fix help text when in a container (#3082)
Updated to 2.1.0 (jsc#SLE-23879)
* Breaking Change: The predicate is now a required flag in the attest
commands, set via the --type flag.
* Enhancements
* Verify sigs and attestations in parallel (#3066)
* Deep inspect attestations when filtering download (#3031)
* refactor bundle validation code, add support for DSSE rekor type (#3016)
* Allow overriding remote options (#3049)
* feat: adds no cert found on sig exit code (#3038)
* Make predicate a required flag in attest commands (#3033)
* Added support for attaching Time stamp authority Response in attach command
(#3001)
* Add sign --sign-container-identity CLI (#2984)
* Feature: Allow cosign to sign digests before they are uploaded. (#2959)
* accepts attachment-tag-prefix for cosign copy (#3014)
* Feature: adds '\--allow-insecure-registry' for cosign load (#3000)
* download attestation: support --platform flag (#2980)
* Cleanup: Add Digest to the SignedEntity interface. (#2960)
* verify command: support keyless verification using only a provided
certificate chain with non-fulcio roots (#2845)
* verify: use workers to limit the paralellism when verifying images with
--max-workers flag (#3069)
* Bug Fixes
* Fix pkg/cosign/errors (#3050)
* Fix: update doc to refer to github-actions oidc provider (#3040)
* Fix: prefer GitHub OIDC provider if enabled (#3044)
* Fix --sig-only in cosign copy (#3074)
* Documentation
* Fix links to sigstore/docs in markdown files (#3064)
Update to 2.0.2 (jsc#SLE-23879)
* Enhancements
* Update sigstore/sigstore to v1.6.2 to pick up TUF CDN change (#2891)
* feat: Make cosign copy faster (#2901)
* remove sget (#2885)
* Require a payload to be provided with a signature (#2785)
* Bug Fixes
* cmd: Change error message from KeyParseError to PubKeyParseError for verify-blob. (#2876)
* Use SOURCE_DATE_EPOCH for OCI CreatedAt times (#2878)
* Documentation
* Remove experimental warning from Fulcio flags (#2923)
* add missing oidc provider (#2922)
* Add zot as a supported registry (#2920)
* deprecates kms_support docs (#2900)
* chore(docs) deprecate note for usage docs (#2906)
* adds note of deprecation for examples.md docs (#2899)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch SUSE-2023-4870=1 openSUSE-SLE-15.4-2023-4870=1
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2023-4870=1
* Basesystem Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4870=1
* Basesystem Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4870=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* cosign-2.2.1-150400.3.14.1
* cosign-debuginfo-2.2.1-150400.3.14.1
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
* cosign-2.2.1-150400.3.14.1
* Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* cosign-2.2.1-150400.3.14.1
* Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* cosign-2.2.1-150400.3.14.1
## References:
* https://www.suse.com/security/cve/CVE-2023-46737.html
* https://bugzilla.suse.com/show_bug.cgi?id=1216933
* https://jira.suse.com/browse/SLE-23879
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20231214/337f91e8/attachment.htm>
More information about the sle-updates
mailing list