Bug 2499687 (CVE-2026-48815)
| Summary: | CVE-2026-48815 sigstore: Sigstore: Unauthorized certificates accepted due to ignored `certificateOIDs` verification option | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | anthomas, bbrownin, dfreiber, drow, dschmidt, eborisov, ehelms, ggainey, gtanzill, jburrell, jbuscemi, jlanda, jpasqual, juwatts, kshier, lball, mdellweg, mhulan, mstipich, ngough, nmoumoul, osousa, pcreech, rchan, rekumar, rexwhite, rhel-process-autobot, sdawley, simaishi, smallamp, stcannon, sthirugn, teagle, tmalecek, veshanka, vkumar, vvoronko, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in sigstore. The `certificateOIDs` option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface (API) but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing security policies that rely on specific certificate extension object identifiers (OIDs). As a result, applications that depend on this option for security receive no protection, potentially leading to the acceptance of malicious or untrusted artifacts.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-07-13 14:40:09 UTC
|