Threats Tagged 'cve-2025-11065'

This security update for cosign version 3.0.5 addresses multiple vulnerabilities including improper certificate validation, path traversal allowing arbitrary file writes, SSRF via URL validation bypass, denial of service from invalid metadata, unauthorized metadata modification, sensitive information leaks in logs, and memory consumption issues. These fixes resolve issues that could lead to undefined behavior, arbitrary internal service access, denial of service, information disclosure, and acceptance of invalid verification entries. The update is provided by the SUSE Product Security Team and affects specific cosign package versions.

This security update for Trivy addresses multiple vulnerabilities across various dependencies including hashicorp/go-getter, golang.org/x/crypto/ssh, golang.org/x/net/html, github.com/golang-jwt/jwt, and others. The fixes cover issues such as argument injection, authorization bypass, denial of service, memory consumption, information leaks, and code execution. The update also includes other non-security related fixes and dependency upgrades. No specific affected versions of Trivy are stated in the provided data.

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.