Description
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Published: 2026-09-16
Score: 7.4 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 17:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Title Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
First Time appeared Redhat
Redhat ansible Automation Platform
Redhat confidential Compute Attestation
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Redhat satellite
Redhat trusted Profile Analyzer
Weaknesses CWE-347
CPEs cpe:/a:redhat:ansible_automation_platform:2
cpe:/a:redhat:confidential_compute_attestation:1
cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/a:redhat:satellite:6
cpe:/a:redhat:trusted_profile_analyzer:2
cpe:/a:redhat:trusted_profile_analyzer:3
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat ansible Automation Platform
Redhat confidential Compute Attestation
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Redhat satellite
Redhat trusted Profile Analyzer
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N'}

Subscriptions

Redhat Ansible Automation Platform Confidential Compute Attestation Enterprise Linux Hummingbird Openshift Satellite Trusted Profile Analyzer
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-16T16:56:11.638Z

Reserved: 2026-04-29T15:09:53.696Z

Link: CVE-2026-42784

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-16T17:17:18.380

Modified: 2026-09-16T17:17:18.380

Link: CVE-2026-42784

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-347

    Improper Verification of Cryptographic Signature