{"id":"CVE-2026-42784","aliases":["ALSA-2026:76733","ALSA-2026:76734","ALSA-2026:76735","ALSA-2026:76737","AZL-105170","DEBIAN-CVE-2026-42784","EUVD-2026-80888","GHSA-g33h-rrj9-75qv","RHSA-2026:34160","RHSA-2026:42078","RHSA-2026:42902","RHSA-2026:76733","RHSA-2026:76734","RHSA-2026:76735","RHSA-2026:76737","RLSA-2026:76733","RLSA-2026:76734","RLSA-2026:76735","RLSA-2026:76737","UBUNTU-CVE-2026-42784"],"status":"published","title":"Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion","description":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00335,"percentile":0.27273,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2026-07-02T10:17:34Z","modified":"2026-11-11T05:55:47Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"rpm-sequoia","fixed_in":["1.10.2.1-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"rpm-sequoia-devel","fixed_in":["1.10.2.1-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"rpm-sequoia","fixed_in":["1.10.2.1-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"rpm-sequoia-devel","fixed_in":["1.10.2.1-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"sequoia-sqv","fixed_in":["1.3.0.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"sequoia-sq","fixed_in":["1.4.0.1-2.el10_2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers-cc","fixed_in":["3.15.0.aks0-23"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-sequoia-openpgp","fixed_in":["2.2.0-2"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"podman-sequoia","fixed_in":["0:0.3.2-4.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rust-podman-sequoia","fixed_in":["0:0.3.2-4.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rpm-sequoia","fixed_in":["0:1.10.2.1-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rpm-sequoia-debuginfo","fixed_in":["0:1.10.2.1-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rust-rpm-sequoia","fixed_in":["0:1.10.2.1-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rust-rpm-sequoia-debugsource","fixed_in":["0:1.10.2.1-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"rpm-sequoia-debuginfo","fixed_in":["0:1.10.2.1-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"rpm-sequoia-devel","fixed_in":["0:1.10.2.1-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"rust-rpm-sequoia-debugsource","fixed_in":["0:1.10.2.1-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rpm-sequoia","fixed_in":["0:1.10.2.1-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rpm-sequoia-debuginfo","fixed_in":["0:1.10.2.1-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-rpm-sequoia","fixed_in":["0:1.10.2.1-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-rpm-sequoia-debugsource","fixed_in":["0:1.10.2.1-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rpm-sequoia-devel","fixed_in":["0:1.10.2.1-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-sequoia-sqv","fixed_in":["0:1.3.0.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-sequoia-sqv-debugsource","fixed_in":["0:1.3.0.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"sequoia-sqv","fixed_in":["0:1.3.0.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"sequoia-sqv-debuginfo","fixed_in":["0:1.3.0.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-sequoia-sq","fixed_in":["0:1.4.0.1-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-sequoia-sq-debugsource","fixed_in":["0:1.4.0.1-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"sequoia-sq","fixed_in":["0:1.4.0.1-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"sequoia-sq-debuginfo","fixed_in":["0:1.4.0.1-2.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"rust-rpm-sequoia","fixed_in":["0:1.10.2.1-1.el9_8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"rust-rpm-sequoia","fixed_in":["0:1.10.2.1-1.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"rust-sequoia-sqv","fixed_in":["0:1.3.0.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"rust-sequoia-sq","fixed_in":["0:1.4.0.1-2.el10_2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"rpm-sequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2.1-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rpm-sequoia-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2.1-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rpm-sequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2.1-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rpm-sequoia-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2.1-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sequoia-sqv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sequoia-sq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.1-2.el10_2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0.aks0-23"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.0-2","1.13.0-1","1.16.0-1","1.16.0-2","1.16.0-3","1.16.1-1","1.16.1-2","1.17.0-1","1.17.0-2","1.18.0-1","1.19.0-1","1.20.0-1","1.20.0-2","1.21.0-1","1.21.1-1","1.21.1-2","1.21.2-1","1.21.2-2","1.22.0-1","1.22.0-2","2.0.0-1","2.0.0-2","2.0.0-3","2.0.0-4","2.0.0-5","2.1.0-1","2.1.0-2","2.1.0-3","2.2.0-1","2.2.0-2","2.3.0-1","2.4.1-1","2.4.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-2","2.0.0-2+deb13u1","2.0.0-3","2.0.0-4","2.0.0-5","2.1.0-1","2.1.0-2","2.1.0-3","2.2.0-1","2.2.0-2","2.3.0-1","2.4.1-1","2.4.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-2"}]}],"versions":["2.0.0-2","2.0.0-3","2.0.0-4","2.0.0-5","2.1.0-1","2.1.0-2","2.1.0-3","2.2.0-1"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.10-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pysequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pysequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pysequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.63-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.63-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.50-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.50-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.25.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.19.12-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pysequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pysequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pysequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.25.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.19.12-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pysequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pysequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pysequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podman-sequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-4.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-podman-sequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-4.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rpm-sequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rpm-sequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rust-rpm-sequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rust-rpm-sequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"rpm-sequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"rpm-sequoia-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"rust-rpm-sequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rpm-sequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rpm-sequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-rpm-sequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-rpm-sequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rpm-sequoia-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-sequoia-sqv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-sequoia-sqv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sequoia-sqv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sequoia-sqv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-sequoia-sq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0.1-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-sequoia-sq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0.1-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sequoia-sq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0.1-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sequoia-sq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0.1-2.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rust-rpm-sequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el9_8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"rust-rpm-sequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.2.1-1.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"rust-sequoia-sqv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"rust-sequoia-sq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0.1-2.el10_2"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-3","1.3.0-4","1.7.0-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-1","1.17.0-1","1.17.0-2","1.18.0-1","1.19.0-1","1.19.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.0-1","2.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1","2.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-2","2.0.0-5","2.1.0-1","2.1.0-2","2.1.0-3","2.2.0-1"]}],"products":[{"vendor":"red hat","product":"confidential compute attestation"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6 for rhel 9"},{"vendor":"red hat","product":"red hat cost management on-premise 1"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat trusted profile analyzer"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:34160","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42078","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42902","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76733","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76734","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76735","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76737","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79357","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94791","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98248","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42784","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464122","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42784","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g33h-rrj9-75qv"},{"url":"https://bugzilla.redhat.com/2464122","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-76733.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-76734.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-76735.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-76737.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42784","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487949","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461147","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466684","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34160.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6322","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33154","tags":["advisory"]},{"url":"https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/releases/tag/3.2.13","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41240","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.0","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42035","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42784","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44293","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44293","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44431","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44432","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44488","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44488","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44495","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44495","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526","tags":["advisory"]},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487943","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490703","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42078.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6321","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6321","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8643","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8643","tags":["advisory"]},{"url":"https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11332","tags":["advisory"]},{"url":"https://github.com/ansible/ansible","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12382","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12701","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","tags":["advisory"]},{"url":"https://go.dev/cl/781703","tags":["article"]},{"url":"https://go.dev/issue/79574","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5029","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","tags":["advisory"]},{"url":"https://go.dev/cl/781685","tags":["article"]},{"url":"https://go.dev/issue/79575","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","tags":["advisory"]},{"url":"https://go.dev/cl/758061","tags":["article"]},{"url":"https://go.dev/issue/78281","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4946","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33811","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","tags":["advisory"]},{"url":"https://go.dev/cl/767860","tags":["article"]},{"url":"https://go.dev/issue/78803","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4981","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39821","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","tags":["advisory"]},{"url":"https://go.dev/cl/767220","tags":["article"]},{"url":"https://go.dev/issue/78760","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5026","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42044","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42044","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44244","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44486","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44486","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44487","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44487","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44492","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44492","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44494","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44494","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44496","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44496","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42902.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76733.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76734.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76735.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76737.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76733","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76734","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76735","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76737","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-42784","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-42784","title":"Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion","description":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.","status":"published","published":"2026-09-16T16:56:11.638Z","modified":"2026-11-11T05:55:47.781Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-11T06:54:11.720276Z"}],"euvd":[{"id":"EUVD-2026-80888","description":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.","status":"published","published":"2026-09-16T16:56:11Z","modified":"2026-11-11T05:55:47Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-11T07:27:42.761079Z"}],"ghsa":[{"id":"GHSA-g33h-rrj9-75qv","title":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older...","description":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.","status":"published","published":"2026-09-16T18:32:03Z","modified":"2026-11-11T06:33:33Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-11T07:02:44.364748Z"}],"nvd":[{"id":"CVE-2026-42784","description":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.","status":"published","published":"2026-09-16T17:17:18.38Z","modified":"2026-11-11T06:17:20.64Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-11T12:24:42.120303Z"}],"osv":[{"id":"DEBIAN-CVE-2026-42784","description":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.","status":"published","published":"2026-09-16T17:17:18.38Z","modified":"2026-11-11T09:47:31.816090747Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-11T10:35:40.696585Z"},{"id":"RHSA-2026:34160","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-07-02T10:17:34Z","modified":"2026-10-20T10:31:02.583742233Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:42078","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-07-23T10:13:55Z","modified":"2026-10-20T10:08:58Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:42902","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:12:40Z","modified":"2026-10-16T10:17:56Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:76733","title":"Red Hat Security Advisory: rust-rpm-sequoia security update","status":"published","published":"2026-10-07T10:20:03Z","modified":"2026-10-16T10:25:51Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76734","title":"Red Hat Security Advisory: rust-rpm-sequoia security, bug fix, and enhancement update","status":"published","published":"2026-10-07T10:20:04Z","modified":"2026-10-16T10:25:52Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76735","title":"Red Hat Security Advisory: rust-sequoia-sqv security update","status":"published","published":"2026-10-07T10:20:05Z","modified":"2026-10-16T10:25:53Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76737","title":"Red Hat Security Advisory: rust-sequoia-sq security, bug fix, and enhancement update","status":"published","published":"2026-10-08T10:20:01Z","modified":"2026-10-16T10:25:53Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:76733","title":"Important: rust-rpm-sequoia security update","description":"An implementation of the RPM PGP interface using Sequoia.\n\nSecurity Fix(es):\n\n* sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-07T06:05:54.740077Z","modified":"2026-10-07T06:30:02.473281846Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:76734","title":"Important: rust-rpm-sequoia security, bug fix, and enhancement update","description":"An implementation of the RPM PGP interface using Sequoia.\n\nSecurity Fix(es):\n\n* sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)\n\nBug Fix(es) and Enhancement(s):\n\n* Uninformative error message on --import failure [rhel-10.2.z] (JIRA:Rocky Linux-176906)\n\n* Return NotTrusted importing non-allowed keys [rhel-10.2.z] (JIRA:Rocky Linux-176907)\n\n* [FTBFS] Update bindgen for LLVM 22 compatibility [rhel-10.2.z] (JIRA:Rocky Linux-176908)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-07T12:11:09.662802Z","modified":"2026-10-07T12:30:02.561994022Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:76735","title":"Important: rust-sequoia-sqv security update","description":"A simple OpenPGP signature verification program.\n\nSecurity Fix(es):\n\n* sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-07T12:10:19.768697Z","modified":"2026-10-07T12:30:02.561897023Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:76737","title":"Important: rust-sequoia-sq security, bug fix, and enhancement update","description":"Command-line frontends for Sequoia.\n\nSecurity Fix(es):\n\n* sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)\n\nBug Fix(es) and Enhancement(s):\n\n* Unbundle capnproto from sequoia-sq [rhel-10.2.z] (JIRA:Rocky Linux-177547)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-07T18:10:06.02302Z","modified":"2026-10-07T18:30:04.397175803Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-42784","description":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.","status":"published","published":"2026-09-16T17:17:00Z","modified":"2026-10-17T12:58:16.236453979Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"ALSA-2026:76733","title":"Important: rust-rpm-sequoia security update","description":"An implementation of the RPM PGP interface using Sequoia.  \n\nSecurity Fix(es):  \n\n  * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:32:37.666037947Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:76734","title":"Important: rust-rpm-sequoia security, bug fix, and enhancement update","description":"An implementation of the RPM PGP interface using Sequoia.  \n\nSecurity Fix(es):  \n\n  * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Uninformative error message on --import failure [almalinux-10.2.z] (JIRA:AlmaLinux-176906)\n  * Return NotTrusted importing non-allowed keys [almalinux-10.2.z] (JIRA:AlmaLinux-176907)\n  * [FTBFS] Update bindgen for LLVM 22 compatibility [almalinux-10.2.z] (JIRA:AlmaLinux-176908)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:30:50.323964495Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:76735","title":"Important: rust-sequoia-sqv security update","description":"A simple OpenPGP signature verification program.  \n\nSecurity Fix(es):  \n\n  * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:30:08.498337675Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:76737","title":"Important: rust-sequoia-sq security, bug fix, and enhancement update","description":"Command-line frontends for Sequoia.  \n\nSecurity Fix(es):  \n\n  * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Unbundle capnproto from sequoia-sq [almalinux-10.2.z] (JIRA:AlmaLinux-177547)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:30:50.822889441Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-105170","title":"CVE-2026-42784 affecting package kata-containers-cc for versions less than 3.15.0.aks0-23","description":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.","status":"published","published":"2026-09-16T17:17:18Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.719431Z"}]}}