A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpm-sequoia-develUpgrade rpm-sequoia | Oct 11, 2026 | Oct 6, 2026 |
| Redhat_linux | — | Upgrade rust-sequoia-sqv-debugsourceUpgrade rpm-sequoiaUpgrade rust-sequoia-sq-debugsourceUpgrade sequoia-sqv-debuginfoUpgrade rust-rpm-sequoia-debugsourceUpgrade sequoia-sq-debuginfoUpgrade sequoia-sqvUpgrade rpm-sequoia-develUpgrade sequoia-sqUpgrade rpm-sequoia-debuginfoNo solution exists | Sep 18, 2026 | Sep 16, 2026 |
| Rocky_linux | — | Upgrade rust-rpm-sequoia-debugsourceUpgrade rpm-sequoiaUpgrade sequoia-sqv-debuginfoUpgrade rust-sequoia-sq-debugsourceUpgrade rpm-sequoia-develUpgrade rpm-sequoia-debuginfoUpgrade sequoia-sq-debuginfoUpgrade sequoia-sqvUpgrade sequoia-sqUpgrade rust-sequoia-sqv-debugsource | Oct 8, 2026 | Oct 7, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub