{
  "cveId": "CVE-2025-46569",
  "url": "https://patchblox.com/security/cve/CVE-2025-46569",
  "summary": "CVE-2025-46569 is fixed in 2 products on 1 platform, first by SUSE-SU-2025:02592-1, released August 1, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "OPA server Data API HTTP path injection of Rego",
  "description": "This update for cosign fixes the following issues:\n\nUpdate to version 2.5.3 (jsc#SLE-23879):\n\n- CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego (bsc#1246725)\n\nChangelog:\n\nUpdate to 2.5.3:\n\n- Add signing-config create command (#4280)\n- Allow multiple services to be specified for trusted-root create (#4285)\n- force when copying the latest image to overwrite (#4298)\n- Fix cert verification logic for trusted-root/SCTs (#4294)\n- Fix lint error for types package (#4295)\n- feat: Add OCI 1.1\u002B experimental support to tree (#4205)\n- Add validity period end for trusted-root create (#4271)\n- avoid double-loading trustedroot from file (#4264)\n\nUpdate to 2.5.2:\n\n- Do not load trusted root when CT env key is set\n- docs: improve doc for --no-upload option (#4206)\n\nUpdate to 2.5.1:\n\n- Add Rekor v2 support for trusted-root create (#4242)\n- Add baseUrl and Uri to trusted-root create command\n- Upgrade to TUF v2 client with trusted root\n- Don\u0027t verify SCT for a private PKI cert (#4225)\n- Bump TSA library to relax EKU chain validation rules (#4219)\n- Bump sigstore-go to pick up log index=0 fix (#4162)\n- remove unused recursive flag on attest command (#4187)",
  "published": "2025-07-11T05:00:00Z",
  "severity": "Important",
  "cwe": "Incorrect Authorization",
  "epss": 0.00541,
  "epssPercentile": 0.45723,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-46569",
  "fixes": [
    {
      "platform": "linux",
      "product": "cosign",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.5.3-150400.3.30.1",
      "fix": "SUSE-SU-2025:02592-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-02592-1",
      "released": "2025-08-01T14:44:01Z"
    },
    {
      "platform": "linux",
      "product": "cosign",
      "release": "sles 15.6",
      "fixedVersion": "2.5.3-150400.3.30.1",
      "fix": "SUSE-SU-2025:02592-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-02592-1",
      "released": "2025-08-01T14:44:01Z"
    },
    {
      "platform": "linux",
      "product": "cosign",
      "release": "sles 15.7",
      "fixedVersion": "2.5.3-150400.3.30.1",
      "fix": "SUSE-SU-2025:02592-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-02592-1",
      "released": "2025-08-01T14:44:01Z"
    },
    {
      "platform": "linux",
      "product": "hauler",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.3.1-bp160.1.1",
      "fix": "OPENSUSE-SU-2025:20160-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20160-1",
      "released": "2025-12-12T13:20:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}