IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.4Hoch

CVE-2026-42784Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support;… Veröffentlicht: (vor 1 Monat)

Beschreibung

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

Schwachstellentyp (CWE): CWE-347

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
ansible automation platform 2.6 —
ansible automation platform developer 2.6 —
cost management on premise 1 —
enterprise linux 9 —
Red Hat Confidential Compute Attestation —
Red Hat Red Hat Ansible Automation Platform 2 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 all versions
Red Hat Red Hat Cost Management On-Premise 1 all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Hardened Images all versions
Red Hat Red Hat OpenShift Container Platform 4 all versions
Red Hat Red Hat Satellite 6.16 for RHEL 8 all versions
Red Hat Red Hat Satellite 6.16 for RHEL 9 all versions
Red Hat Red Hat Satellite 6.17 for RHEL 9 all versions
Red Hat Red Hat Satellite 6.18 for RHEL 9 all versions
Red Hat Red Hat Satellite 6.19 for RHEL 9 all versions
Red Hat Red Hat Trusted Profile Analyzer all versions
satellite 6.16 —
satellite 6.17 —
satellite 6.18 —
satellite 6.19 —
satellite capsule 6.16 —
satellite capsule 6.17 —
satellite capsule 6.18 —
satellite capsule 6.19 —
satellite maintenance 6.17 —
satellite maintenance 6.18 —
satellite utils 6.16 —
satellite utils 6.17 —
satellite utils 6.18 —
satellite utils 6.19 —

Referenzen und Patches

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

5.5Mittel
CVE-2026-110330

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Hoch
CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…