Red Hat Security Advisory

RHSA-2026:2136

RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release

Released 2026-02-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/gitsign-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9 +1

TI-2026-18290 CVE-2026-22772 · GHSA-59jp-pj84-45mr

HIGH 65

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00232 Published 2026-01-12 Partial fix · 1.8.5 CWE-918

TI-2025-30317 CVE-2025-47913 · GHSA-56w8-48fp-6mgv

MEDIUM 40

SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00668 Published 2025-11-13 Partial fix · 0.43.0 CWE-617

TI-2025-40928 CVE-2025-66506 · GHSA-f83f-xpx7-ffpw

LOW 38

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00226 Published 2025-12-04 Partial fix · 1.8.3 CWE-405

TI-2025-38131 CVE-2025-61729 · GHSA-7c64-f9jr-v9h2

LOW 33

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0049 Published 2025-12-02 Partial fix · 1.24.11, 1.25.5 CWE-295