Red Hat Security AdvisoryRHSA-2026:6926
Red Hat Quay 3.9.20
Released 2026-04-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
Fixes 8 records
Priority HIGH 77
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00499 · Published 2026-03-23 · Partial fix · 11.1.1 CWE-681
Priority HIGH 74
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verificati…
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0036 · Published 2026-03-23 · Partial fix · 11.1.1 CWE-347
Priority HIGH 72
PyJWT is a JSON Web Token implementation in Python.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00299 · Published 2026-03-12 · Partial fix · 2.12.0 CWE-345
Priority HIGH 72
pyasn1 is a generic ASN.1 library for Python.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00835 · Published 2026-03-18 · Partial fix · 0.6.3 CWE-674
Priority MEDIUM 49
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1…
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00485 · Published 2026-03-23 · Partial fix · 11.1.1 CWE-1023
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-03-06 · Partial fix · 3.8.3, 4.3.7 +2 CWE-1321
Priority MEDIUM 42
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation.
CVSS 4.0CRITICAL 9.4· Network · No auth · No interaction · EPSS 0.00305 · Published 2026-03-23 · Partial fix · 11.1.1 CWE-325
Priority MEDIUM 40
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00702 · Published 2026-03-06 · Partial fix · 2.8.1, 3.3.3 +1 CWE-776
THREATIST.IORead the docs