Summary
An implementation of the RPM PGP interface using Sequoia.
Security Fix(es):
* sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)
Bug Fix(es) and Enhancement(s):
* Uninformative error message on --import failure [almalinux-10.2.z] (JIRA:AlmaLinux-176906)
* Return NotTrusted importing non-allowed keys [almalinux-10.2.z] (JIRA:AlmaLinux-176907)
* [FTBFS] Update bindgen for LLVM 22 compatibility [almalinux-10.2.z] (JIRA:AlmaLinux-176908)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | rpm-sequoia | 1.10.2.1-1.el10_2 |
| AlmaLinux · 10 | rpm-sequoia-devel | 1.10.2.1-1.el10_2 |
Vulnerabilities 1
-
High 7.4
Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the b…