CVE-2026-42784
Fixed in a distro release EPSS <1%CVSS 7.4
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Products: Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Cost Management On-Premise 1, Red Hat Hardened Images, Red Hat Confidential Compute Attestation, Red Hat Ansible Automation Platform 2, Red Hat OpenShift Container Platform 4, Red Hat Satellite 6, Red Hat Trusted Profile Analyzer
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | rpm-sequoia | 1.10.2.1-1.el10_2 |
| AlmaLinux 10 | rpm-sequoia-devel | 1.10.2.1-1.el10_2 |
| AlmaLinux 10 | sequoia-sq | 1.4.0.1-2.el10_2 |
| AlmaLinux 10 | sequoia-sqv | 1.3.0.2-1.el10_2 |
| AlmaLinux 9 | rpm-sequoia | 1.10.2.1-1.el9_8 |
| AlmaLinux 9 | rpm-sequoia-devel | 1.10.2.1-1.el9_8 |
| Debian 12 | rust-sequoia-openpgp | no fix |
| Debian 13 | rust-sequoia-openpgp | no fix |
| Debian 14 | rust-sequoia-openpgp | 2.2.0-2 |
| Red Hat ansible automation platform 2.5 | ansible-core | 1:2.16.19-1.el8ap |
| Red Hat ansible automation platform 2.5 | ansible-core | 1:2.16.19-1.el9ap |
| Red Hat ansible automation platform 2.5 | ansible-test | 1:2.16.19-1.el8ap |
| Red Hat ansible automation platform 2.5 | ansible-test | 1:2.16.19-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller | 0:4.6.30-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-controller | 0:4.6.30-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-cli | 0:4.6.30-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-controller-cli | 0:4.6.30-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-server | 0:4.6.30-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-controller-server | 0:4.6.30-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-ui | 0:4.6.30-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-controller-ui | 0:4.6.30-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.30-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.30-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller | 0:1.1.20-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller | 0:1.1.20-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-base | 0:1.1.20-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-base | 0:1.1.20-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-base-services | 0:1.1.20-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-base-services | 0:1.1.20-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-event-stream-services | 0:1.1.20-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-event-stream-services | 0:1.1.20-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-worker-services | 0:1.1.20-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-worker-services | 0:1.1.20-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway | 0:2.5.20260715-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway | 0:2.5.20260715-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-config | 0:2.5.20260715-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-config | 0:2.5.20260715-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20260715-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20260715-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-hub | 0:4.10.16-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-hub | 0:4.10.16-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-galaxy-ng | 0:4.10.16-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-galaxy-ng | 0:4.10.16-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-gitpython | 0:3.1.50-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-gitpython | 0:3.1.50-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pulp-ansible | 1:0.25.6-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pulp-ansible | 1:0.25.6-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pulp-container | 0:2.19.12-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pulp-container | 0:2.19.12-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pulpcore | 0:3.49.63-2.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pulpcore | 0:3.49.63-2.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pyjwt | 0:2.13.0-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pyjwt | 0:2.13.0-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pyjwt+crypto | 0:2.13.0-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pyjwt+crypto | 0:2.13.0-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pysequoia | 0:0.1.34-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pysequoia | 0:0.1.34-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pysequoia-debuginfo | 0:0.1.34-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pysequoia-debuginfo | 0:0.1.34-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pysequoia-debugsource | 0:0.1.34-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pysequoia-debugsource | 0:0.1.34-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-urllib3 | 0:2.7.0-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-urllib3 | 0:2.7.0-1.el8ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.6-1.el8ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.6-1.el9ap |
| Red Hat ansible automation platform 2.5 | receptor-debuginfo | 0:1.6.6-1.el8ap |
| Red Hat ansible automation platform 2.5 | receptor-debuginfo | 0:1.6.6-1.el9ap |
| Red Hat ansible automation platform 2.5 | receptor-debugsource | 0:1.6.6-1.el9ap |
| Red Hat ansible automation platform 2.5 | receptor-debugsource | 0:1.6.6-1.el8ap |
| Red Hat ansible automation platform 2.5 | receptorctl | 0:1.6.6-1.el9ap |
| Red Hat ansible automation platform 2.5 | receptorctl | 0:1.6.6-1.el8ap |
| Red Hat ansible automation platform 2.6 | automation-controller | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-cli | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-server | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-ui | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-venv-tower | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform 2.6 | automation-platform-ui | 0:2.6.10-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pyjwt | 0:2.13.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pyjwt+crypto | 0:2.13.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pysequoia | 0:0.1.34-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pysequoia-debuginfo | 0:0.1.34-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pysequoia-debugsource | 0:0.1.34-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-urllib3 | 0:2.7.0-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | ansible-core | 1:2.16.19-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | ansible-core | 1:2.16.19-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | automation-controller | 0:4.6.30-2.el9ap |
| Red Hat ansible automation platform developer 2.5 | automation-controller | 0:4.6.30-2.el8ap |
| Red Hat ansible automation platform developer 2.5 | automation-controller-cli | 0:4.6.30-2.el9ap |
| Red Hat ansible automation platform developer 2.5 | automation-controller-cli | 0:4.6.30-2.el8ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-urllib3 | 0:2.7.0-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-urllib3 | 0:2.7.0-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.6-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.6-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | receptorctl | 0:1.6.6-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptorctl | 0:1.6.6-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller-cli | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-urllib3 | 0:2.7.0-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | ansible-core | 1:2.16.19-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | ansible-core | 1:2.16.19-1.el8ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.6-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.6-1.el8ap |
| Red Hat ansible automation platform inside 2.5 | receptorctl | 0:1.6.6-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptorctl | 0:1.6.6-1.el8ap |
| Red Hat Enterprise Linux 10.2 | rpm-sequoia | 0:1.10.2.1-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | rpm-sequoia-debuginfo | 0:1.10.2.1-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | rpm-sequoia-devel | 0:1.10.2.1-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | rust-rpm-sequoia | 0:1.10.2.1-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | rust-rpm-sequoia-debugsource | 0:1.10.2.1-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | rust-sequoia-sq | 0:1.4.0.1-2.el10_2 |
| Red Hat Enterprise Linux 10.2 | rust-sequoia-sq-debugsource | 0:1.4.0.1-2.el10_2 |
| Red Hat Enterprise Linux 10.2 | rust-sequoia-sqv | 0:1.3.0.2-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | rust-sequoia-sqv-debugsource | 0:1.3.0.2-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | sequoia-sq | 0:1.4.0.1-2.el10_2 |
| Red Hat Enterprise Linux 10.2 | sequoia-sq-debuginfo | 0:1.4.0.1-2.el10_2 |
| Red Hat Enterprise Linux 10.2 | sequoia-sqv | 0:1.3.0.2-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | sequoia-sqv-debuginfo | 0:1.3.0.2-1.el10_2 |
| Red Hat Enterprise Linux 9 | rpm-sequoia | 0:1.10.2.1-1.el9_8 |
| Red Hat Enterprise Linux 9 | rpm-sequoia-debuginfo | 0:1.10.2.1-1.el9_8 |
| Red Hat Enterprise Linux 9 | rpm-sequoia-devel | 0:1.10.2.1-1.el9_8 |
| Red Hat Enterprise Linux 9 | rust-rpm-sequoia | 0:1.10.2.1-1.el9_8 |
| Red Hat Enterprise Linux 9 | rust-rpm-sequoia-debugsource | 0:1.10.2.1-1.el9_8 |
| Red Hat hummingbird 1 | podman-sequoia | 0:0.3.2-4.hum1 |
| Red Hat hummingbird 1 | rust-podman-sequoia | 0:0.3.2-4.hum1 |
| Rocky Linux 10 | rust-rpm-sequoia | 0:1.10.2.1-1.el10_2 |
| Rocky Linux 10 | rust-sequoia-sq | 0:1.4.0.1-2.el10_2 |
| Rocky Linux 10 | rust-sequoia-sqv | 0:1.3.0.2-1.el10_2 |
| Rocky Linux 9 | rust-rpm-sequoia | 0:1.10.2.1-1.el9_8 |
| Ubuntu 22.04 LTS | rust-sequoia-openpgp | no fix |
| Ubuntu 24.04 LTS | rust-sequoia-openpgp | no fix |
| Ubuntu 25.10 | rust-sequoia-openpgp | no fix |
| Ubuntu 26.04 LTS | rust-sequoia-openpgp | no fix |
| Ubuntu 26.10 | rust-sequoia-openpgp | no fix |