Bug 2510197 (CVE-2026-59639)
| Summary: | CVE-2026-59639 org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-fips: Bouncy Castle for Java: Cryptographic signature bypass | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | amctagga, anujha, aoconnor, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, bniver, boliveir, bstansbe, dfreiber, dlofthou, drichtar, drow, flucifre, gmeno, groman, istudens, ivassile, iweiss, jburrell, mbenjamin, mhackett, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rhel-process-autobot, rmartinc, rstancel, sostapov, ssilvert, sthorger, thjenkin, vdosoudi, vereddy, vkumar, vmuzikar, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Bouncy Castle for Java. The library's Cryptographic Message Syntax (CMS) component, which handles digital signature verification, incorrectly validates data that has no signers. This means that even if data is not digitally signed, the system might still consider it legitimate. This could allow an attacker to bypass critical security checks and potentially introduce unauthorized or malicious content.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2523389, 2523390, 2523391 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-08-03 02:01:43 UTC
|