https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T16:44:55.499143+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-42784 CVE-2026-42784 — Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion 2026-10-05T16:44:55.514055+00:00

Affected: Red Hat Hardened Images, Red Hat Confidential Compute Attestation, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat Satellite 6, Red Hat Trusted Profile Analyzer

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.