Bug 2510196 (CVE-2026-59641)
| Summary: | CVE-2026-59641 bouncycastle: bcmail-fips: bcjmail-fips: Bouncy Castle for Java: S/MIME signature validation bypass via signer-asserted signing time | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | anujha, asoldano, bbaranow, bmaxwell, bstansbe, dlofthou, gmalinko, istudens, ivassile, iweiss, janstey, mosmerov, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rstancel, rstepani, thjenkin, vdosoudi |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Bouncy Castle for Java. The S/MIME (Secure/Multipurpose Internet Mail Extensions) validator improperly trusts the signing time asserted by the signer during path validation. This could allow an attacker to bypass certificate path validation, potentially leading to the acceptance of invalid or expired certificates. Such an issue can compromise the integrity of signed data.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2524915, 2524924 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-08-03 02:01:41 UTC
|