Description
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | — | — |
| Red Hat | Red Hat Cost Management On-Premise 1 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Confidential Compute Attestation | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat Trusted Profile Analyzer | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-sequoia-openpgp | 2.2.0-2 | — |
| Debian 13 | rust-sequoia-openpgp | No fix yet | — |
| Debian 12 | rust-sequoia-openpgp | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-sequoia-openpgp | No fix yet | — |
| Ubuntu 26.04 LTS | rust-sequoia-openpgp | No fix yet | — |
| Ubuntu 25.10 | rust-sequoia-openpgp | No fix yet | — |
| Ubuntu 24.04 LTS | rust-sequoia-openpgp | No fix yet | — |
| Ubuntu 22.04 LTS | rust-sequoia-openpgp | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rpm-sequoia +2 | 1.10.2.1-1.el10_2 | RHSA-2026:76734 |
| RHEL 10 | sequoia-sq +1 | 1.4.0.1-2.el10_2 | RHSA-2026:76737 |
| RHEL 10 | sequoia-sqv +1 | 1.3.0.2-1.el10_2 | RHSA-2026:76735 |
| RHEL 9 | rpm-sequoia +2 | 1.10.2.1-1.el9_8 | RHSA-2026:76733 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | podman-sequoia +1 | 0.3.2-4.hum1 | RHSA-2026:42902 |
| Red Hat Ansible Automation Platform Inside 2 | ansible-core | 1:2.16.19-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | ansible-core | 1:2.16.19-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.6.30-2.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-urllib3 | 2.7.0-1.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | ansible-core +1 | 1:2.16.19-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.6.30-2.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | automation-eda-controller +4 | 1.1.20-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-gateway +2 | 2.5.20260715-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-hub +1 | 4.10.16-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.10-1.el9ap | RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.50-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulp-ansible | 1:0.25.6-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulp-container | 2.19.12-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulpcore | 3.49.63-2.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.13.0-1.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | python3.12-pysequoia | 0.1.34-1.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | python3.12-urllib3 | 2.7.0-1.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42078 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rpm-sequoia +1 | 1.10.2.1-1.el10_2 | ALSA-2026:76734 |
| AlmaLinux 10 | sequoia-sq | 1.4.0.1-2.el10_2 | ALSA-2026:76737 |
| AlmaLinux 10 | sequoia-sqv | 1.3.0.2-1.el10_2 | ALSA-2026:76735 |
| AlmaLinux 9 | rpm-sequoia +1 | 1.10.2.1-1.el9_8 | ALSA-2026:76733 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | rust-rpm-sequoia | 1.10.2.1-1.el10_2 | RLSA-2026:76734 |
| Rocky Linux 10 | rust-sequoia-sq | 1.4.0.1-2.el10_2 | RLSA-2026:76737 |
| Rocky Linux 10 | rust-sequoia-sqv | 1.3.0.2-1.el10_2 | RLSA-2026:76735 |
| Rocky Linux 9 | rust-rpm-sequoia | 1.10.2.1-1.el9_8 | RLSA-2026:76733 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kata-containers-cc | 3.15.0.aks0-23 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rpm-sequoia +1 | 1.10.2.1-1.el10_2 | ELSA-2026-76734 |
| Oracle Linux 10 | sequoia-sq | 1.4.0.1-2.0.1.el10_2 | ELSA-2026-76737 |
| Oracle Linux 10 | sequoia-sqv | 1.3.0.2-1.el10_2 | ELSA-2026-76735 |
| Oracle Linux 9 | rpm-sequoia +1 | 1.10.2.1-1.el9_8 | ELSA-2026-76733 |
Advisories 20
- WID-SEC-2026-3790 Red Hat Enterprise Linux (sequoia-openpgp, perl-DBI): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:76733 Important: rust-rpm-sequoia security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:76737 Important: rust-sequoia-sq security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:76734 Important: rust-rpm-sequoia security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:76735 Important: rust-sequoia-sqv security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:34160 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:42078 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76735 Red Hat Security Advisory: rust-sequoia-sqv security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:76737 Red Hat Security Advisory: rust-sequoia-sq security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:76734 Red Hat Security Advisory: rust-rpm-sequoia security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:76733 Red Hat Security Advisory: rust-rpm-sequoia security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:42902 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- ELSA-2026-76737 Important: rust-sequoia-sq security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 8, 2026
- RLSA-2026:76737 Important: rust-sequoia-sq security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 7, 2026
- RLSA-2026:76734 Important: rust-rpm-sequoia security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 7, 2026
- RLSA-2026:76735 Important: rust-sequoia-sqv security update Rocky Linux Security Advisories · Oct 7, 2026
- RLSA-2026:76733 Important: rust-rpm-sequoia security update Rocky Linux Security Advisories · Oct 7, 2026
- ELSA-2026-76733 Important: rust-rpm-sequoia security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 7, 2026
- ELSA-2026-76734 Important: rust-rpm-sequoia security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 6, 2026
- ELSA-2026-76735 Important: rust-sequoia-sqv security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 6, 2026
References
- RHSA-2026:100120 vendor-advisory
- RHSA-2026:34160 vendor-advisory
- RHSA-2026:42078 vendor-advisory
- RHSA-2026:42902 vendor-advisory
- RHSA-2026:76733 vendor-advisory
- RHSA-2026:76734 vendor-advisory
- RHSA-2026:76735 vendor-advisory
- RHSA-2026:76737 vendor-advisory
- RHSA-2026:79357 vendor-advisory
- RHSA-2026:94791 vendor-advisory
- RHSA-2026:98248 vendor-advisory
- RHSA-2026:99949 vendor-advisory
- RHSA-2026:99950 vendor-advisory
- RHSA-2026:99952 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-42784 vdb-entry
- RHBZ#2464122 issue-tracking