Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20662-1

Опубликовано: 30 апр. 2026
Источник: suse-cvrf

Описание

Security update for hauler

This update for hauler fixes the following issues:

Changes in hauler:

  • update to 1.4.2 (bsc#1258614, CVE-2026-24122):
    • Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 in the go_modules group across 1 directory
    • fix for new helm chart features
    • Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in the go_modules group across 1 directory
    • Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in the go_modules group across 1 directory
    • Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 in the go_modules group across 1 directory
    • update cosign fork to 3.0.4 plus dep tidy
    • fix: Fix file:// dependency chart path resolution
    • update github.com/olekukonko/tablewriter to v1.1.2
    • keep registry on image rewrite if not specified
    • Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 in the go_modules group across 1 directory
    • fix: handling of file referenced dependencies without repository field
    • Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 in the go_modules group across 1 directory
    • dev.md file
    • smaller changes and updates for v1.4.2 release

Список пакетов

openSUSE Leap 16.0
hauler-1.4.2-bp160.1.1

Ссылки

Описание

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.

Затронутые продукты
openSUSE Leap 16.0:hauler-1.4.2-bp160.1.1
Ссылки