RHSA-2026:6926
Vulnerability from csaf_redhat - Published: 2026-04-07 21:36 - Updated: 2026-04-08 20:49Summary
Red Hat Security Advisory: Red Hat Quay 3.9.20
Severity
Important
Notes
Topic: Red Hat Quay 3.9.20 is now available with bug fixes.
Details: Quay 3.9.20
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.
9.1 (Critical)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:6926
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.
8.2 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:6926
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.
8.7 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:6926
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:6926
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:6926
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:6926
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:6926
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:6926
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.9.20 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.9.20",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:6926",
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-30922",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4599",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4600",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4601",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4602",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6926.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.9.20",
"tracking": {
"current_release_date": "2026-04-08T20:49:46+00:00",
"generator": {
"date": "2026-04-08T20:49:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.5"
}
},
"id": "RHSA-2026:6926",
"initial_release_date": "2026-04-07T21:36:48+00:00",
"revision_history": [
{
"date": "2026-04-07T21:36:48+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-07T21:36:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-04-08T20:49:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.9",
"product": {
"name": "Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.9::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774886457"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885670"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3Af2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774887042"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775183053"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3A6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775184102"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885725"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aa18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169218"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ac3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885670"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Abfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Af845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885725"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169218"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885670"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Ace200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885725"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169218"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4599",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2026-03-23T06:01:34.008562+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "RHBZ#2450207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4599"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20",
"url": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1",
"url": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/647",
"url": "https://github.com/kjur/jsrsasign/pull/647"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939"
}
],
"release_date": "2026-03-23T05:00:12.522000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces"
},
{
"cve": "CVE-2026-4600",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-23T06:01:39.334925+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450208"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT. The flaw in jsrsasign allows an attacker to forge Digital Signature Algorithm (DSA) signatures or X.509 certificates by providing malicious domain parameters during validation. This could lead to unauthorized access or data manipulation in affected Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, where jsrsasign is utilized for cryptographic signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "RHBZ#2450208",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450208"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4600"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7",
"url": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60",
"url": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/646",
"url": "https://github.com/kjur/jsrsasign/pull/646"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940"
}
],
"release_date": "2026-03-23T05:00:08.475000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters"
},
{
"cve": "CVE-2026-4601",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-03-23T06:01:44.014846+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450209"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: A flaw in the jsrsasign library allows for private key recovery due to a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process. An attacker can manipulate signature generation within the KJUR.crypto.DSA.signWithMessageHash function to force specific values, enabling the recovery of the private key. This impacts Red Hat products utilizing jsrsasign, such as Migration Toolkit for Virtualization and Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "RHBZ#2450209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450209"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4601"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586",
"url": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb",
"url": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/645",
"url": "https://github.com/kjur/jsrsasign/pull/645"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941"
}
],
"release_date": "2026-03-23T05:00:13.312000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing"
},
{
"cve": "CVE-2026-4602",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-03-23T06:01:28.729668+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450206"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT flaw. The `jsrsasign` library, as used in Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, is vulnerable to a signature verification bypass. A remote attacker could provide a specially crafted negative exponent to the `modPow` function, leading to incorrect modular inverse computations and allowing them to bypass signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "RHBZ#2450206",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450206"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5",
"url": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195",
"url": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/650",
"url": "https://github.com/kjur/jsrsasign/pull/650"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175"
}
],
"release_date": "2026-03-23T05:00:10.567000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T08:01:07.142613+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-30922",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-18T04:02:45.401296+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448553"
}
],
"notes": [
{
"category": "description",
"text": "An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "RHBZ#2448553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-30922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0",
"url": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"
}
],
"release_date": "2026-03-18T02:29:45.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…