Bug 2464122 (CVE-2026-42784) - CVE-2026-42784 sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion
Summary: CVE-2026-42784 sequoia-openpgp: sequoia-openpgp: Cryptographic integrity comp...
Keywords:
Status: NEW
Alias: CVE-2026-42784
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-30 14:13 UTC by OSIDB Bzimport
Modified: 2026-11-12 23:47 UTC (History)
45 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:76733 0 None None None 2026-10-06 13:41:21 UTC
Red Hat Product Errata RHSA-2026:76734 0 None None None 2026-10-06 12:10:04 UTC
Red Hat Product Errata RHSA-2026:76735 0 None None None 2026-10-06 15:04:00 UTC
Red Hat Product Errata RHSA-2026:76737 0 None None None 2026-10-07 09:07:22 UTC
Red Hat Product Errata RHSA-2026:98248 0 None None None 2026-11-11 05:35:31 UTC
Red Hat Product Errata RHSA-2026:99949 0 None None None 2026-11-12 23:46:19 UTC
Red Hat Product Errata RHSA-2026:99950 0 None None None 2026-11-12 23:46:58 UTC
Red Hat Product Errata RHSA-2026:99952 0 None None None 2026-11-12 23:47:58 UTC

Description OSIDB Bzimport 2026-04-30 14:13:09 UTC 
A vulnerability was found in sequoia-openpgp. The library incorrectly infers key flags from the public key algorithm for older certificates when a key flags subpacket is absent. Because SubpacketAreas::key_flags and ValidKeyAmalgamation::key_flags return different views of the key capabilities, the validation logic can be circumvented. An attacker can exploit this key flag confusion to bypass the back-signature check, allowing them to illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Comment 4 Jon Orris 2026-10-06 12:10:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:76734 https://access.redhat.com/errata/RHSA-2026:76734
Comment 5 Jon Orris 2026-10-06 13:41:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:76733 https://access.redhat.com/errata/RHSA-2026:76733
Comment 6 Jon Orris 2026-10-06 15:03:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:76735 https://access.redhat.com/errata/RHSA-2026:76735
Comment 7 Jon Orris 2026-10-07 09:07:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:76737 https://access.redhat.com/errata/RHSA-2026:76737
Comment 9 errata-xmlrpc 2026-11-11 05:35:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:98248 https://access.redhat.com/errata/RHSA-2026:98248
Comment 10 errata-xmlrpc 2026-11-12 23:46:15 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:99949 https://access.redhat.com/errata/RHSA-2026:99949
Comment 11 errata-xmlrpc 2026-11-12 23:46:55 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:99950 https://access.redhat.com/errata/RHSA-2026:99950
Comment 12 errata-xmlrpc 2026-11-12 23:47:55 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:99952 https://access.redhat.com/errata/RHSA-2026:99952
Note You need to log in before you can comment on or make changes to this bug.