CVE-2026-75939: falha de alta gravidade em Red Hat OpenShift Container Platform 4
Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.4epss 0.4%
A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenShift Container Platform 4.18Red Hat · Red Hat OpenShift Container Platform 5CVEs relacionadas — Red Hat OpenShift Container Platform 4
No mesmo produto, das mais perigosas para as menos.
CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.5%CVE-2025-10230CRITICALSamba: command injection in wins server hook scriptEPSS 39.8%CVE-2025-26466MEDIUMOpenssh: denial-of-service in opensshEPSS 38.7%CVE-2026-4480CRITICALSamba: samba: remote code execution in printing subsystem via unescaped job descriptionEPSS 28.7%CVE-2024-12085HIGHRsync: info leak via uninitialized stack contentsEPSS 8.6%