Skip to content
OpenAdvisories
Medium RHSA-2026:47889 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 4, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 spire1.14 0:1.14.7-0.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 spire1.14-agent 0:1.14.7-0.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 spire1.14-oidc-discovery-provider 0:1.14.7-0.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 spire1.14-server 0:1.14.7-0.3.hum1

Vulnerabilities 2

  • Medium 5.9
    CVE-2026-49834

    sigstore-go: Multi-log threshold bypass via single compromised log

    sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log autho…

    sigstore sigstore-go kubescape zarf Debian Ubuntu Wolfi Go
  • Low 3.1
    CVE-2026-54787

    sigstore-go fails to check signature timestamps against a signing key's validity period

    sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which …

    sigstore sigstore-go zot kubescape Debian Ubuntu Azure Linux Wolfi Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-49834
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-54787
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47889.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2501871
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49834
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49834
  • article
    https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207
  • article
    https://github.com/sigstore/sigstore-go/pull/633
  • article
    https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0
  • article
    https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509939
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-54787
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-54787
  • article
    https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f
  • article
    https://github.com/sigstore/sigstore-go/pull/642
  • article
    https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1
  • article
    https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm