{
  "affected": [
    {
      "affectedData": [
        {
          "product": "sigstore-go",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."
    }
  ],
  "id": "CVE-2026-54787",
  "lastModified": "2026-08-01T00:17:17.040",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54787",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-31T23:35:40.966529Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-31T23:17:25.287",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sigstore/sigstore-go/pull/642"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-324"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.2.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/sigstore/sigstore-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54787"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-324"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T21:58:39Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "sigstore-go fails to check signature timestamps against a signing key\u0027s validity period for self-managed long-lived keys without certificates.\n\n## Impact\n\nTo verify a bundle with a self-managed long-lived key, the key needs to be wrapped in an `ExpiringKey` type that implies expiration semantics:\n\n```go\nsignatureVerifier, _ := signature.LoadDefaultVerifier(publicKey)\nexpiredKey := root.NewExpiringKey(signatureVerifier, time.Unix(0, 0), time.Unix(1, 0))\n```\n\nDespite the API contract, the validator does not check the bundle signing time against the validity window. Attackers that obtain expired key materials may be able to sign bundles with those materials that are accepted despite a configured expiry date. This issue only impacts the long-lived signing key workflow, and not standard deployments involving a certificate authority.\n\n## Reproduction steps\n\nStart from a sigstore-go checkout:\n\n```bash\ngit clone https://github.com/sigstore/sigstore-go.git\ncd sigstore-go\ngit checkout 8ca80c47ef03d26ebf174db7c296700b075b2c16\n```\n\nApply the [patch] containing the test case and associated materials:\n\n```bash\ngit apply sigstore-go-public-key-validity-test.patch\n```\n\nRun the test:\n\n```bash\ngo test ./pkg/verify -run TestPublicKeyValidityCheckedAgainstSignedTimestamp\n```\n\nOn vulnerable code, the test fails because verification succeeds even though the trusted `ExpiringKey` is not valid at the signed timestamp:\n\n```text\n--- FAIL: TestPublicKeyValidityCheckedAgainstSignedTimestamp\n    signed_entity_test.go:602:\n        \tError:      \tAn error is expected but got nil.\n```\n\n[patch]: https://github.com/user-attachments/files/28614520/sigstore-go-public-key-validity-test.patch",
  "id": "GHSA-wqqc-jjcq-vfxm",
  "modified": "2026-07-31T21:58:39Z",
  "published": "2026-07-31T21:58:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sigstore/sigstore-go/pull/642"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sigstore/sigstore-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "sigstore-go fails to check signature timestamps against a signing key\u0027s validity period"
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key\u0027s validity period - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-54787.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "sigstore-go fails to check signature timestamps against a signing key\u0027s validity period",
    "tracking": {
      "current_release_date": "2026-08-23T14:42:24.000Z",
      "generator": {
        "date": "2026-08-24T07:04:20.155Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-54787",
      "initial_release_date": "2026-08-07T01:13:03.000Z",
      "revision_history": [
        {
          "date": "2026-08-07T01:13:03.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-08-23T14:42:24.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 gh 0:2.62.0-20.azl3",
                "product": {
                  "name": "\u003cazl3 gh 0:2.62.0-20.azl3",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 gh 0:2.62.0-20.azl3",
                "product": {
                  "name": "azl3 gh 0:2.62.0-20.azl3",
                  "product_id": "21668"
                }
              }
            ],
            "category": "product_name",
            "name": "gh"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 gh 0:2.62.0-20.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 gh 0:2.62.0-20.azl3 as a component of Azure Linux 3.0",
          "product_id": "21668-17084"
        },
        "product_reference": "21668",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-54787",
      "cwe": {
        "id": "CWE-324",
        "name": "Use of a Key Past its Expiration Date"
      },
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "21668-17084"
        ],
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key\u0027s validity period - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-54787.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-07T01:13:03.000Z",
          "details": "0:2.97.0-1.azl3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 3.1,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "17084-1"
          ]
        }
      ],
      "title": "sigstore-go fails to check signature timestamps against a signing key\u0027s validity period"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nspire1.15:\n  * spire1.15-1.15.2-0.3.hum1 (aarch64, x86_64)\n  * spire1.15-agent-1.15.2-0.3.hum1 (aarch64, x86_64)\n  * spire1.15-oidc-discovery-provider-1.15.2-0.3.hum1 (aarch64, x86_64)\n  * spire1.15-server-1.15.2-0.3.hum1 (aarch64, x86_64)\n  * spire1.15-1.15.2-0.3.hum1.src (src)\n\nSecurity Fix(es):\n\nspire1.15:\n  * CVE-2026-56852",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:44162",
        "url": "https://access.redhat.com/errata/RHSA-2026:44162"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49834",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49834"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54787",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54787"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44162.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-25T18:28:32+00:00",
      "generator": {
        "date": "2026-08-25T18:28:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:44162",
      "initial_release_date": "2026-07-23T03:29:54+00:00",
      "revision_history": [
        {
          "date": "2026-07-23T03:29:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-25T18:28:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "spire1-15-main@aarch64",
                "product": {
                  "name": "spire1-15-main@aarch64",
                  "product_id": "spire1-15-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spire1.15@1.15.2-0.3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "spire1-15-main@src",
                "product": {
                  "name": "spire1-15-main@src",
                  "product_id": "spire1-15-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spire1.15@1.15.2-0.3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "spire1-15-main@x86_64",
                "product": {
                  "name": "spire1-15-main@x86_64",
                  "product_id": "spire1-15-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spire1.15@1.15.2-0.3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spire1-15-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:spire1-15-main@aarch64"
        },
        "product_reference": "spire1-15-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spire1-15-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:spire1-15-main@src"
        },
        "product_reference": "spire1-15-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spire1-15-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:spire1-15-main@x86_64"
        },
        "product_reference": "spire1-15-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49834",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-07-17T20:01:10.164173+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2501871"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency (CT) log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log, thereby defeating the intended security policy and potentially compromising the integrity of the verification process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:spire1-15-main@aarch64",
          "Red Hat Hardened Images:spire1-15-main@src",
          "Red Hat Hardened Images:spire1-15-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49834"
        },
        {
          "category": "external",
          "summary": "RHBZ#2501871",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501871"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49834",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49834"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49834",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49834"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207",
          "url": "https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/pull/633",
          "url": "https://github.com/sigstore/sigstore-go/pull/633"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0",
          "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6",
          "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6"
        }
      ],
      "release_date": "2026-07-17T19:20:06.140000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-23T03:29:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:spire1-15-main@aarch64",
            "Red Hat Hardened Images:spire1-15-main@src",
            "Red Hat Hardened Images:spire1-15-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:44162"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:spire1-15-main@aarch64",
            "Red Hat Hardened Images:spire1-15-main@src",
            "Red Hat Hardened Images:spire1-15-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log"
    },
    {
      "cve": "CVE-2026-54787",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-07-31T23:00:53.185348+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509939"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in sigstore-go, a software library used for verifying digital signatures. This vulnerability specifically affects the workflow for self-managed long-lived signing keys that do not use certificates. An attacker who possesses an expired signing key can exploit this by creating and signing software bundles that the system will incorrectly accept as valid. This bypasses the intended security checks, potentially leading to the acceptance of unauthorized or malicious software.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:spire1-15-main@aarch64",
          "Red Hat Hardened Images:spire1-15-main@src",
          "Red Hat Hardened Images:spire1-15-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509939",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509939"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54787",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54787",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f",
          "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/pull/642",
          "url": "https://github.com/sigstore/sigstore-go/pull/642"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1",
          "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm",
          "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
        }
      ],
      "release_date": "2026-07-31T21:58:14.156000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-23T03:29:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:spire1-15-main@aarch64",
            "Red Hat Hardened Images:spire1-15-main@src",
            "Red Hat Hardened Images:spire1-15-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:44162"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:spire1-15-main@aarch64",
            "Red Hat Hardened Images:spire1-15-main@src",
            "Red Hat Hardened Images:spire1-15-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:spire1-15-main@aarch64",
          "Red Hat Hardened Images:spire1-15-main@src",
          "Red Hat Hardened Images:spire1-15-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-23T03:29:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:spire1-15-main@aarch64",
            "Red Hat Hardened Images:spire1-15-main@src",
            "Red Hat Hardened Images:spire1-15-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:44162"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:spire1-15-main@aarch64",
            "Red Hat Hardened Images:spire1-15-main@src",
            "Red Hat Hardened Images:spire1-15-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:spire1-15-main@aarch64",
            "Red Hat Hardened Images:spire1-15-main@src",
            "Red Hat Hardened Images:spire1-15-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ncosign:\n  * cosign-3.1.2-0.2.hum1 (aarch64, x86_64)\n  * cosign-3.1.2-0.2.hum1.src (src)\n\nSecurity Fix(es):\n\ncosign:\n  * CVE-2026-56852",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:44451",
        "url": "https://access.redhat.com/errata/RHSA-2026:44451"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54787",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54787"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44451.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-25T18:28:46+00:00",
      "generator": {
        "date": "2026-08-25T18:28:46+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:44451",
      "initial_release_date": "2026-07-23T11:46:28+00:00",
      "revision_history": [
        {
          "date": "2026-07-23T11:46:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-24T00:04:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-25T18:28:46+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-main@aarch64",
                "product": {
                  "name": "cosign-main@aarch64",
                  "product_id": "cosign-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cosign@3.1.2-0.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-main@src",
                "product": {
                  "name": "cosign-main@src",
                  "product_id": "cosign-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cosign@3.1.2-0.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-main@x86_64",
                "product": {
                  "name": "cosign-main@x86_64",
                  "product_id": "cosign-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cosign@3.1.2-0.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:cosign-main@aarch64"
        },
        "product_reference": "cosign-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:cosign-main@src"
        },
        "product_reference": "cosign-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:cosign-main@x86_64"
        },
        "product_reference": "cosign-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-54787",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-07-31T23:00:53.185348+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509939"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in sigstore-go, a software library used for verifying digital signatures. This vulnerability specifically affects the workflow for self-managed long-lived signing keys that do not use certificates. An attacker who possesses an expired signing key can exploit this by creating and signing software bundles that the system will incorrectly accept as valid. This bypasses the intended security checks, potentially leading to the acceptance of unauthorized or malicious software.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:cosign-main@aarch64",
          "Red Hat Hardened Images:cosign-main@src",
          "Red Hat Hardened Images:cosign-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509939",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509939"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54787",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54787",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f",
          "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/pull/642",
          "url": "https://github.com/sigstore/sigstore-go/pull/642"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1",
          "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm",
          "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
        }
      ],
      "release_date": "2026-07-31T21:58:14.156000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-23T11:46:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:cosign-main@aarch64",
            "Red Hat Hardened Images:cosign-main@src",
            "Red Hat Hardened Images:cosign-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:44451"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:cosign-main@aarch64",
            "Red Hat Hardened Images:cosign-main@src",
            "Red Hat Hardened Images:cosign-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:cosign-main@aarch64",
          "Red Hat Hardened Images:cosign-main@src",
          "Red Hat Hardened Images:cosign-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-23T11:46:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:cosign-main@aarch64",
            "Red Hat Hardened Images:cosign-main@src",
            "Red Hat Hardened Images:cosign-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:44451"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:cosign-main@aarch64",
            "Red Hat Hardened Images:cosign-main@src",
            "Red Hat Hardened Images:cosign-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:cosign-main@aarch64",
            "Red Hat Hardened Images:cosign-main@src",
            "Red Hat Hardened Images:cosign-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nspire1.14:\n  * spire1.14-1.14.7-0.3.hum1 (aarch64, x86_64)\n  * spire1.14-agent-1.14.7-0.3.hum1 (aarch64, x86_64)\n  * spire1.14-oidc-discovery-provider-1.14.7-0.3.hum1 (aarch64, x86_64)\n  * spire1.14-server-1.14.7-0.3.hum1 (aarch64, x86_64)\n  * spire1.14-1.14.7-0.3.hum1.src (src)\n\nSecurity Fix(es):\n\nspire1.14:\n  * CVE-2026-49834",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:47889",
        "url": "https://access.redhat.com/errata/RHSA-2026:47889"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49834",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49834"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54787",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54787"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47889.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-24T15:20:44+00:00",
      "generator": {
        "date": "2026-08-24T15:20:44+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:47889",
      "initial_release_date": "2026-07-29T13:21:56+00:00",
      "revision_history": [
        {
          "date": "2026-07-29T13:21:56+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-24T15:20:44+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "spire1-14-main@aarch64",
                "product": {
                  "name": "spire1-14-main@aarch64",
                  "product_id": "spire1-14-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spire1.14@1.14.7-0.3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "spire1-14-main@src",
                "product": {
                  "name": "spire1-14-main@src",
                  "product_id": "spire1-14-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spire1.14@1.14.7-0.3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "spire1-14-main@x86_64",
                "product": {
                  "name": "spire1-14-main@x86_64",
                  "product_id": "spire1-14-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spire1.14@1.14.7-0.3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spire1-14-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:spire1-14-main@aarch64"
        },
        "product_reference": "spire1-14-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spire1-14-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:spire1-14-main@src"
        },
        "product_reference": "spire1-14-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spire1-14-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:spire1-14-main@x86_64"
        },
        "product_reference": "spire1-14-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49834",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-07-17T20:01:10.164173+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2501871"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency (CT) log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log, thereby defeating the intended security policy and potentially compromising the integrity of the verification process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:spire1-14-main@aarch64",
          "Red Hat Hardened Images:spire1-14-main@src",
          "Red Hat Hardened Images:spire1-14-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49834"
        },
        {
          "category": "external",
          "summary": "RHBZ#2501871",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501871"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49834",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49834"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49834",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49834"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207",
          "url": "https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/pull/633",
          "url": "https://github.com/sigstore/sigstore-go/pull/633"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0",
          "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6",
          "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6"
        }
      ],
      "release_date": "2026-07-17T19:20:06.140000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T13:21:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:spire1-14-main@aarch64",
            "Red Hat Hardened Images:spire1-14-main@src",
            "Red Hat Hardened Images:spire1-14-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47889"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:spire1-14-main@aarch64",
            "Red Hat Hardened Images:spire1-14-main@src",
            "Red Hat Hardened Images:spire1-14-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log"
    },
    {
      "cve": "CVE-2026-54787",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-07-31T23:00:53.185348+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509939"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in sigstore-go, a software library used for verifying digital signatures. This vulnerability specifically affects the workflow for self-managed long-lived signing keys that do not use certificates. An attacker who possesses an expired signing key can exploit this by creating and signing software bundles that the system will incorrectly accept as valid. This bypasses the intended security checks, potentially leading to the acceptance of unauthorized or malicious software.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:spire1-14-main@aarch64",
          "Red Hat Hardened Images:spire1-14-main@src",
          "Red Hat Hardened Images:spire1-14-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509939",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509939"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54787",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54787",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f",
          "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/pull/642",
          "url": "https://github.com/sigstore/sigstore-go/pull/642"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1",
          "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm",
          "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
        }
      ],
      "release_date": "2026-07-31T21:58:14.156000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T13:21:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:spire1-14-main@aarch64",
            "Red Hat Hardened Images:spire1-14-main@src",
            "Red Hat Hardened Images:spire1-14-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47889"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:spire1-14-main@aarch64",
            "Red Hat Hardened Images:spire1-14-main@src",
            "Red Hat Hardened Images:spire1-14-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ntrivy:\n  * trivy-0.72.0-0.1.3.hum1 (aarch64, x86_64)\n  * trivy-0.72.0-0.1.3.hum1.src (src)\n\nSecurity Fix(es):\n\ntrivy:\n  * CVE-2026-49834",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:47891",
        "url": "https://access.redhat.com/errata/RHSA-2026:47891"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49834",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49834"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54787",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54787"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47891.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-24T22:56:27+00:00",
      "generator": {
        "date": "2026-08-24T22:56:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:47891",
      "initial_release_date": "2026-07-29T13:28:25+00:00",
      "revision_history": [
        {
          "date": "2026-07-29T13:28:25+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-24T22:56:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-main@aarch64",
                "product": {
                  "name": "trivy-main@aarch64",
                  "product_id": "trivy-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/trivy@0.72.0-0.1.3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-main@src",
                "product": {
                  "name": "trivy-main@src",
                  "product_id": "trivy-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/trivy@0.72.0-0.1.3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-main@x86_64",
                "product": {
                  "name": "trivy-main@x86_64",
                  "product_id": "trivy-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/trivy@0.72.0-0.1.3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:trivy-main@aarch64"
        },
        "product_reference": "trivy-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:trivy-main@src"
        },
        "product_reference": "trivy-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:trivy-main@x86_64"
        },
        "product_reference": "trivy-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49834",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-07-17T20:01:10.164173+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2501871"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency (CT) log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log, thereby defeating the intended security policy and potentially compromising the integrity of the verification process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:trivy-main@aarch64",
          "Red Hat Hardened Images:trivy-main@src",
          "Red Hat Hardened Images:trivy-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49834"
        },
        {
          "category": "external",
          "summary": "RHBZ#2501871",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501871"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49834",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49834"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49834",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49834"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207",
          "url": "https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/pull/633",
          "url": "https://github.com/sigstore/sigstore-go/pull/633"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0",
          "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6",
          "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6"
        }
      ],
      "release_date": "2026-07-17T19:20:06.140000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T13:28:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:trivy-main@aarch64",
            "Red Hat Hardened Images:trivy-main@src",
            "Red Hat Hardened Images:trivy-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47891"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:trivy-main@aarch64",
            "Red Hat Hardened Images:trivy-main@src",
            "Red Hat Hardened Images:trivy-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log"
    },
    {
      "cve": "CVE-2026-54787",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-07-31T23:00:53.185348+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509939"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in sigstore-go, a software library used for verifying digital signatures. This vulnerability specifically affects the workflow for self-managed long-lived signing keys that do not use certificates. An attacker who possesses an expired signing key can exploit this by creating and signing software bundles that the system will incorrectly accept as valid. This bypasses the intended security checks, potentially leading to the acceptance of unauthorized or malicious software.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:trivy-main@aarch64",
          "Red Hat Hardened Images:trivy-main@src",
          "Red Hat Hardened Images:trivy-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509939",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509939"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54787",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54787",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54787"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f",
          "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/pull/642",
          "url": "https://github.com/sigstore/sigstore-go/pull/642"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1",
          "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm",
          "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
        }
      ],
      "release_date": "2026-07-31T21:58:14.156000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T13:28:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:trivy-main@aarch64",
            "Red Hat Hardened Images:trivy-main@src",
            "Red Hat Hardened Images:trivy-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47891"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:trivy-main@aarch64",
            "Red Hat Hardened Images:trivy-main@src",
            "Red Hat Hardened Images:trivy-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys"
    }
  ]
}