Debian/cosign: medium 5.5
Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor
Action: Upgrade cosign to 2.6.2-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.6.2-1 | - |
Fixed versions
| 2.6.2-1 |
Sources
- osv: DEBIAN-CVE-2026-22703#Debian:14/cosign
- https://security-tracker.debian.org/tracker/CVE-2026-22703
published · modified · JSON