THREATIST.IORead the docs RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
Released 2026-07-16 · Red Hat rating Important · View on Red Hat →
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
The RSA and DSA public key parsers did not enforce size limits on key parameters.
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.