https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:16:59 +0000 https://vulnerability.circl.lu/vuln/ghsa-h8cp-697h-8c8p <p><strong>Affected:</strong> Go: github.com/smallstep/certificates</p> <p>## Summary</p> <p>A security fix is now available for Step CA that resolves a vulnerability affecting deployments configured with ACME and/or SCEP provisioners. All operators running these provisioners should upgrade to the latest release (`v0.29.0`) immediately.</p> <p>The issue was discovered and disclosed by a research team during a security review. There is no evidence of active exploitation.</p> <p>To limit exploitation risk during a coordinated disclosure window, we are withholding detailed technical information for now. A full write-up will be published in several weeks.</p> <p>---</p> <p>## Embargo List</p> <p>If your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.</p> <p>---</p> <p>## Acknowledgements</p> <p>This issue was identified and reported by Stephen Kubik of the Cisco Advanced Security Initiatives Group (ASIG)</p> <p>---</p> <p>Stay safe, and thank you for helping us keep the ecosystem secure.</p> <p><strong>Affected:</strong> Go: github.com/smallstep/certificates</p> <p>## Summary</p> <p>A security fix is now available for Step CA that resolves a vulnerability affecting deployments configured with ACME and/or SCEP provisioners. All operators running these provisioners should upgrade to the latest release (`v0.29.0`) immediately.</p> <p>The issue was discovered and disclosed by a research team during a security review. There is no evidence of active exploitation.</p> <p>To limit exploitation risk during a coordinated disclosure window, we are withholding detailed technical information for now. A full write-up will be published in several weeks.</p> <p>---</p> <p>## Embargo List</p> <p>If your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.</p> <p>---</p> <p>## Acknowledgements</p> <p>This issue was identified and reported by Stephen Kubik of the Cisco Advanced Security Initiatives Group (ASIG)</p> <p>---</p> <p>Stay safe, and thank you for helping us keep the ecosystem secure.</p> https://vulnerability.circl.lu/vuln/ghsa-h8cp-697h-8c8p