Red Hat Security Advisory

RHSA-2026:50869

RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release

Released 2026-08-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9

TI-2026-28713 CVE-2026-39831 · GHSA-89gr-r52h-f8rx

MEDIUM 48

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00478 Published 2026-05-22 Partial fix · 0.52.0 CWE-862

TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2

LOW 39

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00473 Published 2026-05-22 Partial fix · 0.52.0 CWE-704

TI-2026-32627 CVE-2026-44740 · GHSA-m3xc-h892-ggx6

LOW 29

Billy is an interface filesystem abstraction for Go.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-06-01 Partial fix · 5.9.0, 6.0.0-alpha.1 CWE-674