Bug 2510206 (CVE-2026-59643)
| Summary: | CVE-2026-59643 org.bouncycastle/bc-java: org.bouncycastle/bcpg-fips: Bouncy Castle for Java: Data integrity compromise due to silently ignored OpenPGP inline-signature policy failures | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Bouncy Castle for Java and Bouncy Castle for Java FIPS (BC-FJA). This vulnerability allows an attacker to bypass OpenPGP inline-signature policy failures, which are silently ignored by the software. This silent disregard of policy failures can lead to a compromise of data integrity, as users may mistakenly believe that signature policies are being enforced when they are not. This could result in the acceptance of maliciously altered or unauthorized data.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-08-03 02:02:11 UTC
|