https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:16:15 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0315 certfr-2026-avi-0315 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0315 https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cosign</p> <p>Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cosign</p> <p>Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 https://cve.radiocsirt.org/vuln/euvd-2026-266497 EUVD-2026-266497 https://cve.radiocsirt.org/vuln/euvd-2026-266497 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24137 <p>sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.</p> <p>sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-24137 https://cve.radiocsirt.org/vuln/ghsa-fcv2-xgw5-pqxf <p><strong>Affected:</strong> Go: github.com/sigstore/sigstore</p> <p>## Summary</p> <p>The legacy TUF client `pkg/tuf/client.go`, which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base directory.</p> <p>Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. As this TUF client implementation is deprecated, users should migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf as soon as possible.</p> <p>Note that this does not affect users of the public Sigstore deployment, where TUF metadata is validated by a quorum of trusted collaborators.</p> <p>## Impact</p> <p>A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has.</p> <p>## Workarounds</p> <p>Users can disable disk caching for the legacy client by setting `SIGSTORE_NO_CACHE=true` in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.</p> <p><strong>Affected:</strong> Go: github.com/sigstore/sigstore</p> <p>## Summary</p> <p>The legacy TUF client `pkg/tuf/client.go`, which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base directory.</p> <p>Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. As this TUF client implementation is deprecated, users should migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf as soon as possible.</p> <p>Note that this does not affect users of the public Sigstore deployment, where TUF metadata is validated by a quorum of trusted collaborators.</p> <p>## Impact</p> <p>A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has.</p> <p>## Workarounds</p> <p>Users can disable disk caching for the legacy client by setting `SIGSTORE_NO_CACHE=true` in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.</p> https://cve.radiocsirt.org/vuln/ghsa-fcv2-xgw5-pqxf https://cve.radiocsirt.org/vuln/opensuse-su-2026:10230-1 <p>vexctl-0.4.1+git78.f951e3a-1.1 on GA media</p> <p>vexctl-0.4.1+git78.f951e3a-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10230-1 https://cve.radiocsirt.org/vuln/suse-su-2026:0592-1 <p>Security update for vexctl</p> <p>Security update for vexctl</p> https://cve.radiocsirt.org/vuln/suse-su-2026:0592-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-24137 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-github-sigstore-sigstore, Ubuntu:25.10: golang-github-sigstore-sigstore, Ubuntu:26.04:LTS: golang-github-sigstore-sigstore</p> <p>sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-github-sigstore-sigstore, Ubuntu:25.10: golang-github-sigstore-sigstore, Ubuntu:26.04:LTS: golang-github-sigstore-sigstore</p> <p>sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-24137