RHSA-2026:50869
Vulnerability from csaf_redhat - Published: 2026-08-05 17:50 - Updated: 2026-08-10 14:58Summary
Red Hat Security Advisory: RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release
Severity
Important
Notes
Topic: The 1.4.3 release of Red Hat Trusted Artifact Signer OpenShift Operator.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4
Details: The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.
8.1 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x | — |
Vendor Fix
fix
|
Known not affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64 | — |
Threats
Impact
Important
A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64 | — |
Workaround
|
Threats
Impact
Important
References
30 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The 1.4.3 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"title": "Topic"
},
{
"category": "general",
"text": "The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50869",
"url": "https://access.redhat.com/errata/RHSA-2026:50869"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39831",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44740",
"url": "https://access.redhat.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46597",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50869.json"
}
],
"title": "Red Hat Security Advisory: RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release",
"tracking": {
"current_release_date": "2026-08-10T14:58:16+00:00",
"generator": {
"date": "2026-08-10T14:58:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHSA-2026:50869",
"initial_release_date": "2026-08-05T17:50:42+00:00",
"revision_history": [
{
"date": "2026-08-05T17:50:42+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-10T14:58:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Trusted Artifact Signer 1.4",
"product": {
"name": "Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Trusted Artifact Signer"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"product": {
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"product_id": "registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cosign-rhel9@sha256%3Ac41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/cosign-rhel9\u0026tag=1785391606"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"product": {
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"product_id": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/fetch-tsa-certs-rhel9@sha256%3Abbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/fetch-tsa-certs-rhel9\u0026tag=1785391383"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"product": {
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"product_id": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"product_identification_helper": {
"purl": "pkg:oci/gitsign-rhel9@sha256%3Ae1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/gitsign-rhel9\u0026tag=1785359547"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"product": {
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"product_id": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rekor-cli-rhel9@sha256%3A2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/rekor-cli-rhel9\u0026tag=1785391524"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"product": {
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"product_id": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/updatetree-rhel9@sha256%3Aadc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/updatetree-rhel9\u0026tag=1785391426"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"product": {
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"product_id": "registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cosign-rhel9@sha256%3A73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c?arch=arm64\u0026repository_url=registry.redhat.io/rhtas/cosign-rhel9\u0026tag=1785391606"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"product": {
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"product_id": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"product_identification_helper": {
"purl": "pkg:oci/fetch-tsa-certs-rhel9@sha256%3Ab3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3?arch=arm64\u0026repository_url=registry.redhat.io/rhtas/fetch-tsa-certs-rhel9\u0026tag=1785391383"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"product": {
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"product_id": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"product_identification_helper": {
"purl": "pkg:oci/gitsign-rhel9@sha256%3A05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca?arch=arm64\u0026repository_url=registry.redhat.io/rhtas/gitsign-rhel9\u0026tag=1785359547"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"product": {
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"product_id": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/rekor-cli-rhel9@sha256%3Aadf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a?arch=arm64\u0026repository_url=registry.redhat.io/rhtas/rekor-cli-rhel9\u0026tag=1785391524"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64",
"product": {
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64",
"product_id": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64",
"product_identification_helper": {
"purl": "pkg:oci/updatetree-rhel9@sha256%3Ad3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356?arch=arm64\u0026repository_url=registry.redhat.io/rhtas/updatetree-rhel9\u0026tag=1785391426"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"product": {
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"product_id": "registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cosign-rhel9@sha256%3A05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3?arch=ppc64le\u0026repository_url=registry.redhat.io/rhtas/cosign-rhel9\u0026tag=1785391606"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"product": {
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"product_id": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/fetch-tsa-certs-rhel9@sha256%3A54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653?arch=ppc64le\u0026repository_url=registry.redhat.io/rhtas/fetch-tsa-certs-rhel9\u0026tag=1785391383"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"product": {
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"product_id": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/gitsign-rhel9@sha256%3A010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf?arch=ppc64le\u0026repository_url=registry.redhat.io/rhtas/gitsign-rhel9\u0026tag=1785359547"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"product": {
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"product_id": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/rekor-cli-rhel9@sha256%3A2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608?arch=ppc64le\u0026repository_url=registry.redhat.io/rhtas/rekor-cli-rhel9\u0026tag=1785391524"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"product": {
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"product_id": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/updatetree-rhel9@sha256%3A9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f?arch=ppc64le\u0026repository_url=registry.redhat.io/rhtas/updatetree-rhel9\u0026tag=1785391426"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"product": {
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"product_id": "registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cosign-rhel9@sha256%3Aca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9?arch=s390x\u0026repository_url=registry.redhat.io/rhtas/cosign-rhel9\u0026tag=1785391606"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"product": {
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"product_id": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"product_identification_helper": {
"purl": "pkg:oci/fetch-tsa-certs-rhel9@sha256%3Ac261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10?arch=s390x\u0026repository_url=registry.redhat.io/rhtas/fetch-tsa-certs-rhel9\u0026tag=1785391383"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"product": {
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"product_id": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"product_identification_helper": {
"purl": "pkg:oci/gitsign-rhel9@sha256%3A599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143?arch=s390x\u0026repository_url=registry.redhat.io/rhtas/gitsign-rhel9\u0026tag=1785359547"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"product": {
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"product_id": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"product_identification_helper": {
"purl": "pkg:oci/rekor-cli-rhel9@sha256%3Ade3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216?arch=s390x\u0026repository_url=registry.redhat.io/rhtas/rekor-cli-rhel9\u0026tag=1785391524"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"product": {
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"product_id": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/updatetree-rhel9@sha256%3A689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0?arch=s390x\u0026repository_url=registry.redhat.io/rhtas/updatetree-rhel9\u0026tag=1785391426"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le"
},
"product_reference": "registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64"
},
"product_reference": "registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64"
},
"product_reference": "registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x"
},
"product_reference": "registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le"
},
"product_reference": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64"
},
"product_reference": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64"
},
"product_reference": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x"
},
"product_reference": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le"
},
"product_reference": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64"
},
"product_reference": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x"
},
"product_reference": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64"
},
"product_reference": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le"
},
"product_reference": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64"
},
"product_reference": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64"
},
"product_reference": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x"
},
"product_reference": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x"
},
"product_reference": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le"
},
"product_reference": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64"
},
"product_reference": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
},
"product_reference": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39831",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-22T04:01:12.861178+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480675"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "RHBZ#2480675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://go.dev/cl/781662",
"url": "https://go.dev/cl/781662"
},
{
"category": "external",
"summary": "https://go.dev/issue/79566",
"url": "https://go.dev/issue/79566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5019",
"url": "https://pkg.go.dev/vuln/GO-2026-5019"
}
],
"release_date": "2026-05-22T02:31:27.436000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T17:50:42+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50869"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
},
{
"cve": "CVE-2026-44740",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-01T17:01:53.685793+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483894"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity issue. The `go-billy` library, a Go filesystem abstraction, is vulnerable to a denial of service when processing crafted or malformed input, such as untrusted repository data or filesystem structures. Insufficient validation and missing safety mechanisms can lead to panics, infinite loops, or excessive resource consumption, potentially impacting the availability of applications that rely on this library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "RHBZ#2483894",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483894"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44740",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44740"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/releases/tag/v5.9.0",
"url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1",
"url": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6",
"url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
}
],
"release_date": "2026-06-01T16:04:50.358000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T17:50:42+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50869"
},
{
"category": "workaround",
"details": "To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation"
},
{
"cve": "CVE-2026-46597",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-05-22T04:01:21.721980+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in `golang.org/x/crypto/ssh` allows a remote attacker to trigger a server-side panic by sending specially crafted inputs to the AES-GCM packet decoder. This vulnerability could lead to service unavailability in Red Hat products that incorporate and expose SSH services built with the affected `golang.org/x/crypto/ssh` component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "RHBZ#2480678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://go.dev/cl/781620",
"url": "https://go.dev/cl/781620"
},
{
"category": "external",
"summary": "https://go.dev/issue/79561",
"url": "https://go.dev/issue/79561"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5013",
"url": "https://pkg.go.dev/vuln/GO-2026-5013"
}
],
"release_date": "2026-05-22T02:31:26.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T17:50:42+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50869"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:05184a85ae6e96793f187f93627e8d2ce2c33965df2af53acda0c74955a685a3_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:73501c06ced3fe1a280238b611871b4cd99b646ea2cad5768605f9c1266fc56c_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:c41399a432868f51897c762b2ece554848b06ba40c1f3248dcf100dc2e3d503d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/cosign-rhel9@sha256:ca97d62040ea5c0d0c79a6f049005aa6045d0ab12cf26ed3895b53326e9c36b9_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:54cbc07d0994830217da416e6292ba71d1390bc234380a85eb06b9f7e94e4653_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b3f6e07279a1fccf9c711d6b1ecb32aaf8090bb0bb452e2c16e8ad907051e9c3_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:bbbd8f5159ed8beaa3ca98114efd6b6381c359ed9341a188470f47942b98606f_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c261d440478b843d22f4fdc96b1d757eb386c82a0a9e9e06259e0306caf83c10_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:010e5b279bfd40a84ab0bc84b56a6b1df49552c99cf8199d154310d3b014c2cf_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:05eb44a8ecdba9c0366cdf26c43721f32801550bfb340dd38899c734e50b4dca_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:599cda5dbab56f4c93a3e2cd35e74177735dc96680c9809c5dc1765c3bc18143_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/gitsign-rhel9@sha256:e1c9bfa9841fc20055cba3ab6ba99892ae7bc1931db4f23e0d56511a06afadba_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2223653550b5b997b079ba5c454cc0ad1d979194f92555b9d2132dcd0e281608_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:2d6400f3d9ee4db96e5f9d3bc2499500e35e0dc0399df5090a41ff9fde4ac729_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:adf057ecf3b9220adfd0ac4aeca581652539f49604bb572581cfc2089fc75e0a_arm64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:de3e98edbc00e2d565949afd3273e4e427a67ac43fb3a3960a05cdea88873216_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:689b66e54119ee8204e5bf7ac63d10635272c911d4b43279004a1df98f0d0ec0_s390x",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:9bd519e8a801da58e6f8fcac9aa786d040ca7b626bdb75642e783138082f004f_ppc64le",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:adc83c6f6b1dd619eb8cfbe3e08d07466b762b7b745d0e01df1f96fc64db705b_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/updatetree-rhel9@sha256:d3d715bbe7fb48fe369b81a8c29f9a9288ce30b5a8964206f6cfe36669e95356_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…