CVE-2026-42784highCWE-347

CVE-2026-42784: fallo de gravedad alta en Red Hat Confidential Compute Attestation

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat Enterprise Linux+ Monitorear Red Hat OpenShift Container Platform

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.4epss 0.3%
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Productos afectados
Red Hat · Confidential Compute AttestationRed Hat · Red Hat Ansible Automation Platform 2Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat · Red Hat Cost Management On-Premise 1Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Hardened ImagesRed Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat Satellite 6Red Hat · Red Hat Trusted Profile Analyzer
CVEs relacionadas — Red Hat Confidential Compute Attestation

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-71364HIGHAwx: project archive extraction allows path traversal file writesEPSS 1.7%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2026-12701CRITICALPulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportEPSS 1.2%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2023-50782HIGHPython-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659EPSS 1.1%CVE-2026-44189HIGHAnsible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filenameEPSS 1.0%