{ "document" : { "aggregate_severity" : { "namespace" : "https://access.redhat.com/security/updates/classification/", "text" : "Critical" }, "category" : "csaf_security_advisory", "csaf_version" : "2.0", "distribution" : { "text" : "Copyright © Red Hat, Inc. All rights reserved.", "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "en", "notes" : [ { "category" : "summary", "text" : "The Tech Preview release of the Sigstore A2A image 0.0.2.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5", "title" : "Topic" }, { "category" : "general", "text" : "The Sigstore A2A image can be used to sign and verify AI/ML workloads", "title" : "Details" }, { "category" : "legal_disclaimer", "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title" : "Terms of Use" } ], "publisher" : { "category" : "vendor", "contact_details" : "https://access.redhat.com/security/team/contact/", "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name" : "Red Hat Product Security", "namespace" : "https://www.redhat.com" }, "references" : [ { "category" : "self", "summary" : "https://access.redhat.com/errata/RHSA-2026:95267", "url" : "https://access.redhat.com/errata/RHSA-2026:95267" }, { "category" : "external", "summary" : "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5", "url" : "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5" }, { "category" : "external", "summary" : "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index", "url" : "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-102267", "url" : "https://access.redhat.com/security/cve/CVE-2026-102267" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-102268", "url" : "https://access.redhat.com/security/cve/CVE-2026-102268" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-102271", "url" : "https://access.redhat.com/security/cve/CVE-2026-102271" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-102272", "url" : "https://access.redhat.com/security/cve/CVE-2026-102272" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-102273", "url" : "https://access.redhat.com/security/cve/CVE-2026-102273" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-114605", "url" : "https://access.redhat.com/security/cve/CVE-2026-114605" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-63374", "url" : "https://access.redhat.com/security/cve/CVE-2026-63374" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-97687", "url" : "https://access.redhat.com/security/cve/CVE-2026-97687" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-97689", "url" : "https://access.redhat.com/security/cve/CVE-2026-97689" }, { "category" : "external", "summary" : "https://access.redhat.com/security/updates/classification/", "url" : "https://access.redhat.com/security/updates/classification/" }, { "category" : "self", "summary" : "Canonical URL", "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95267.json" } ], "title" : "Red Hat Security Advisory: RHTAS 1.5.1 - Tech Preview Release Of the Sigstore A2A 0.0.2", "tracking" : { "current_release_date" : "2026-11-11T12:19:29+00:00", "generator" : { "date" : "2026-11-11T12:19:29+00:00", "engine" : { "name" : "Red Hat SDEngine", "version" : "5.4.5" } }, "id" : "RHSA-2026:95267", "initial_release_date" : "2026-11-04T16:31:55+00:00", "revision_history" : [ { "date" : "2026-11-04T16:31:55+00:00", "number" : "1", "summary" : "Initial version" }, { "date" : "2026-11-04T16:32:04+00:00", "number" : "2", "summary" : "Last updated version" }, { "date" : "2026-11-11T12:19:29+00:00", "number" : "3", "summary" : "Last generated version" } ], "status" : "final", "version" : "3" } }, "product_tree" : { "branches" : [ { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "Red Hat Trusted Artifact Signer 1.5", "product" : { "name" : "Red Hat Trusted Artifact Signer 1.5", "product_id" : "Red Hat Trusted Artifact Signer 1.5", "product_identification_helper" : { "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.5::el9" } } } ], "category" : "product_family", "name" : "Red Hat Trusted Artifact Signer" }, { "branches" : [ { "category" : "product_version", "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "product" : { "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "product_id" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "product_identification_helper" : { "purl" : "pkg:oci/rh-sigstore-a2a-rhel9@sha256%3A7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e?arch=amd64&repository_url=registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9&tag=1793624122" } } } ], "category" : "architecture", "name" : "amd64" }, { "branches" : [ { "category" : "product_version", "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "product" : { "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "product_id" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "product_identification_helper" : { "purl" : "pkg:oci/rh-sigstore-a2a-rhel9@sha256%3A820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58?arch=arm64&repository_url=registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9&tag=1793624122" } } } ], "category" : "architecture", "name" : "arm64" }, { "branches" : [ { "category" : "product_version", "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le", "product" : { "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le", "product_id" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le", "product_identification_helper" : { "purl" : "pkg:oci/rh-sigstore-a2a-rhel9@sha256%3Ae6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174?arch=ppc64le&repository_url=registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9&tag=1793624122" } } } ], "category" : "architecture", "name" : "ppc64le" }, { "branches" : [ { "category" : "product_version", "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "product" : { "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "product_id" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "product_identification_helper" : { "purl" : "pkg:oci/rh-sigstore-a2a-rhel9@sha256%3A1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1?arch=s390x&repository_url=registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9&tag=1793624122" } } } ], "category" : "architecture", "name" : "s390x" } ], "category" : "vendor", "name" : "Red Hat" } ], "relationships" : [ { "category" : "default_component_of", "full_product_name" : { "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x as a component of Red Hat Trusted Artifact Signer 1.5", "product_id" : "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x" }, "product_reference" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "relates_to_product_reference" : "Red Hat Trusted Artifact Signer 1.5" }, { "category" : "default_component_of", "full_product_name" : { "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64 as a component of Red Hat Trusted Artifact Signer 1.5", "product_id" : "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64" }, "product_reference" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "relates_to_product_reference" : "Red Hat Trusted Artifact Signer 1.5" }, { "category" : "default_component_of", "full_product_name" : { "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64 as a component of Red Hat Trusted Artifact Signer 1.5", "product_id" : "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64" }, "product_reference" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "relates_to_product_reference" : "Red Hat Trusted Artifact Signer 1.5" }, { "category" : "default_component_of", "full_product_name" : { "name" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le as a component of Red Hat Trusted Artifact Signer 1.5", "product_id" : "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" }, "product_reference" : "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le", "relates_to_product_reference" : "Red Hat Trusted Artifact Signer 1.5" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2026-63374", "cwe" : { "id" : "CWE-295", "name" : "Improper Certificate Validation" }, "discovery_date" : "2026-09-22T21:49:20.725016+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2538958" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in AnyIO. A remote attacker in a privileged network position can bypass Transport Layer Security (TLS) certificate validation when connecting to internationalized domain names. This vulnerability occurs because the framework converts internationalized hostnames using an outdated encoding standard, Internationalizing Domain Names in Applications (IDNA) 2003 instead of IDNA 2008. If network traffic is redirected or intercepted, an attacker can present a legitimate certificate for the mismatched domain name, allowing them to impersonate the intended server and intercept or alter sensitive communications.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as having a Moderate severity for Red Hat products because exploitation requires an attacker to already be positioned to intercept network traffic, and the flaw only manifests when connecting to internationalized domain names containing non-ASCII characters. Within Red Hat supported environments and containerized AI components, workloads predominantly communicate using standard ASCII fully qualified domain names and internal endpoints. Because the defect does not allow remote code execution and requires a prior man-in-the-middle condition, the overall blast radius is constrained to specific redirected sessions.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-63374" }, { "category" : "external", "summary" : "RHBZ#2538958", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2538958" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-63374", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-63374" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-63374", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-63374" }, { "category" : "external", "summary" : "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce", "url" : "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce" }, { "category" : "external", "summary" : "https://github.com/agronholm/anyio/pull/1208", "url" : "https://github.com/agronholm/anyio/pull/1208" }, { "category" : "external", "summary" : "https://github.com/agronholm/anyio/releases/tag/4.14.2", "url" : "https://github.com/agronholm/anyio/releases/tag/4.14.2" }, { "category" : "external", "summary" : "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6", "url" : "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6" } ], "release_date" : "2026-09-22T15:23:14.259000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:31:55+00:00", "details" : "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95267" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding" }, { "cve" : "CVE-2026-97687", "cwe" : { "id" : "CWE-295", "name" : "Improper Certificate Validation" }, "discovery_date" : "2026-09-29T15:44:25.449046+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2543255" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy's TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "Red Hat has evaluated this vulnerability as having an Important impact because a network attacker can exploit corrupted TLS validation states to impersonate an HTTPS proxy, enabling complete interception and manipulation of sensitive communications as well as client credential theft. Successful exploitation depends on specialized application architectures where outgoing requests utilize an HTTPS-capable proxy alongside customized destination TLS parameters that inadvertently override proxy verification. Default Red Hat enterprise deployments that communicate directly with endpoints, utilize traditional HTTP proxies, or rely on standard CONNECT tunneling for end-to-end encryption do not expose this flaw.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-97687" }, { "category" : "external", "summary" : "RHBZ#2543255", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2543255" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-97687", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-97687" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-97687", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-97687" }, { "category" : "external", "summary" : "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465", "url" : "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465" }, { "category" : "external", "summary" : "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3", "url" : "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3" }, { "category" : "external", "summary" : "https://github.com/urllib3/urllib3/pull/5093", "url" : "https://github.com/urllib3/urllib3/pull/5093" }, { "category" : "external", "summary" : "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "url" : "https://github.com/urllib3/urllib3/releases/tag/2.8.0" }, { "category" : "external", "summary" : "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77", "url" : "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77" } ], "release_date" : "2026-09-29T15:30:27.136000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:31:55+00:00", "details" : "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95267" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override" }, { "cve" : "CVE-2026-97689", "cwe" : { "id" : "CWE-770", "name" : "Allocation of Resources Without Limits or Throttling" }, "discovery_date" : "2026-09-29T15:41:38.807723+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2543245" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in urllib3. This flaw allows a Denial of Service (DoS) through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as an Important impact because an untrusted remote server can trigger process crashes and complete denial of service across client applications without requiring authentication or special privileges. In Red Hat environments, urllib3 is integrated across numerous system tools, container workloads, and platform services to handle outbound web communication. The risk specifically manifests when these services process streamed replies from potentially malicious third-party endpoints, whereas workloads restricted to internal or verified infrastructure remain largely unaffected.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-97689" }, { "category" : "external", "summary" : "RHBZ#2543245", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2543245" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-97689", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-97689" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-97689", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-97689" }, { "category" : "external", "summary" : "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed", "url" : "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed" }, { "category" : "external", "summary" : "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "url" : "https://github.com/urllib3/urllib3/releases/tag/2.8.0" }, { "category" : "external", "summary" : "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw", "url" : "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw" } ], "release_date" : "2026-09-29T15:36:05.963000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:31:55+00:00", "details" : "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95267" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser" }, { "cve" : "CVE-2026-102267", "cwe" : { "id" : "CWE-346", "name" : "Origin Validation Error" }, "discovery_date" : "2026-09-28T20:42:16.576688+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2542690" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set (JWKS) endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an untrusted server, allowing the client to accept forged verification keys or potentially exposing sensitive credentials.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as an Important impact because improper handling of HTTP redirects during dynamic key retrieval can allow an adversary to supply forged cryptographic keys or intercept sensitive request headers. In Red Hat environments where services utilize PyJWKClient to fetch JSON Web Key Sets over the network, accepting untrusted key material may compromise token validation and authentication boundaries. Exploitation requires the target service to dynamically resolve keys via HTTP and relies on an attacker's ability to manipulate responses returned by the configured key server.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-102267" }, { "category" : "external", "summary" : "RHBZ#2542690", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2542690" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-102267", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-102267" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102267", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102267" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56", "url" : "https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "url" : "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj", "url" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj" } ], "release_date" : "2026-09-28T20:23:33.556000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:31:55+00:00", "details" : "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95267" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects" }, { "cve" : "CVE-2026-102268", "cwe" : { "id" : "CWE-347", "name" : "Improper Verification of Cryptographic Signature" }, "discovery_date" : "2026-09-28T20:40:56.952621+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2542685" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared secret key, allowing a remote attacker to forge valid authentication tokens and bypass security controls.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pyjwt: PyJWT: Authentication bypass via improper public key validation", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as Critical severity for Red Hat products because an unauthenticated remote attacker could forge valid cryptographic tokens and bypass authentication checks without knowing the private signing key. Exploitation occurs when consuming applications configure token verification to accept both symmetric and asymmetric algorithms simultaneously, allowing an asymmetric public key to be mishandled as a symmetric secret. Deployments that strictly enforce a single algorithm type or validate tokens using JSON Web Key sets do not permit this algorithm confusion and remain unaffected.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-102268" }, { "category" : "external", "summary" : "RHBZ#2542685", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2542685" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-102268", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-102268" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102268", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102268" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07", "url" : "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "url" : "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9", "url" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9" } ], "release_date" : "2026-09-28T20:26:13.674000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:31:55+00:00", "details" : "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95267" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 9.1, "baseSeverity" : "CRITICAL", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Critical" } ], "title" : "pyjwt: PyJWT: Authentication bypass via improper public key validation" }, { "cve" : "CVE-2026-102271", "cwe" : { "id" : "CWE-347", "name" : "Improper Verification of Cryptographic Signature" }, "discovery_date" : "2026-09-28T20:41:35.219179+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2542687" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules (DER) format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code (HMAC) operations. If an application supports both asymmetric and symmetric signing algorithms, a remote attacker knowing the public key can exploit this flaw to forge valid authentication tokens and bypass access controls.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as Important because an attacker can forge valid JSON Web Tokens and bypass authentication mechanisms if public cryptographic keys are mistakenly treated as shared secrets. Exploitation requires a specific application scenario where both asymmetric and HMAC algorithms are concurrently permitted during signature verification and public keys are provided in raw DER binary format. Typical Red Hat product integrations do not employ this vulnerable algorithm combination or key encoding by default, which restricts the overall attack surface in standard production environments.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-102271" }, { "category" : "external", "summary" : "RHBZ#2542687", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2542687" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-102271", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-102271" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102271", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102271" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499", "url" : "https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "url" : "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773", "url" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773" } ], "release_date" : "2026-09-28T20:31:53.066000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:31:55+00:00", "details" : "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95267" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets" }, { "cve" : "CVE-2026-102272", "cwe" : { "id" : "CWE-347", "name" : "Improper Verification of Cryptographic Signature" }, "discovery_date" : "2026-09-28T20:51:42.409127+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2542695" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key (JWK) parser fails to normalize Unicode byte-order marks (BOM). In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to misidentify the public key as a shared symmetric secret. This flaw allows an attacker to forge authenticated JSON Web Tokens (JWT) and bypass authentication controls.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as an Important severity because successful exploitation permits an unauthenticated remote attacker to bypass authentication and forge valid tokens, though exploitation requires specific mixed-algorithm verification settings. In Red Hat environments, exposure is restricted to services that simultaneously allow both symmetric HMAC and asymmetric signature algorithms while parsing public keys that contain byte order marks. Workloads and services that enforce single-algorithm verification policies or utilize standard asymmetric key validation routines are not susceptible to this attack.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-102272" }, { "category" : "external", "summary" : "RHBZ#2542695", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2542695" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-102272", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-102272" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102272", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102272" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291", "url" : "https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "url" : "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947", "url" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947" } ], "release_date" : "2026-09-28T20:36:31.530000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:31:55+00:00", "details" : "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95267" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling" }, { "cve" : "CVE-2026-102273", "cwe" : { "id" : "CWE-347", "name" : "Improper Verification of Cryptographic Signature" }, "discovery_date" : "2026-09-28T20:52:12.127939+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2542697" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in PyJWT. This vulnerability allows an unauthenticated remote attacker to bypass authentication by forging arbitrary JSON Web Tokens (JWTs). When an application allows both symmetric and asymmetric algorithms, PyJWT fails to properly validate public JSON Web Key (JWK) container representations, mistakenly accepting public key material as a symmetric Hash-based Message Authentication Code (HMAC) secret. As a result, an attacker with knowledge of the public key can generate validly signed tokens with arbitrary authenticated claims.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "Red Hat rates this vulnerability as Important because an attacker with access to a public verification key can forge cryptographic tokens to bypass authentication, allowing impersonation of privileged users and unauthorized access to protected application resources. Exploitation is limited to environments where applications concurrently permit symmetric HMAC and asymmetric algorithms while passing public key containers into validation routines.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-102273" }, { "category" : "external", "summary" : "RHBZ#2542697", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2542697" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-102273", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-102273" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102273", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102273" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95", "url" : "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "url" : "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0" }, { "category" : "external", "summary" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w", "url" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w" } ], "release_date" : "2026-09-28T20:38:28.161000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:31:55+00:00", "details" : "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95267" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets" }, { "cve" : "CVE-2026-114605", "cwe" : { "id" : "CWE-606", "name" : "Unchecked Input for Loop Condition" }, "discovery_date" : "2026-10-22T16:42:27.165994+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2559128" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in dnspython. A remote attacker can cause a Denial of Service (DoS) by sending a specially crafted Domain Name System (DNS) message containing excessive compression pointer chains. Because the parser does not enforce a hop limit during name decompression, processing these malformed messages leads to excessive CPU utilization and application unresponsiveness.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as an Important impact because an unauthenticated remote attacker can trigger complete CPU exhaustion and application unresponsiveness without requiring specialized access or privileges. In Red Hat enterprise deployments, the library is embedded across multiple platform services and containerized environments that process network records. Systems are primarily vulnerable when applications accept and decompress wire-format responses from untrusted external name servers.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-114605" }, { "category" : "external", "summary" : "RHBZ#2559128", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2559128" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-114605", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-114605" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-114605", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-114605" }, { "category" : "external", "summary" : "https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023", "url" : "https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023" }, { "category" : "external", "summary" : "https://github.com/rthalley/dnspython/releases/tag/v2.9.0", "url" : "https://github.com/rthalley/dnspython/releases/tag/v2.9.0" }, { "category" : "external", "summary" : "https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m", "url" : "https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m" } ], "release_date" : "2026-10-22T16:25:32.509000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:31:55+00:00", "details" : "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index", "product_ids" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95267" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64", "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal" } ] }