rpm package
almalinux/sequoia-sq
pkg:rpm/almalinux/sequoia-sq
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-93657 | Hig | 7.5 | < 1.4.0.1-4.el10_2 | 1.4.0.1-4.el10_2 | Sep 18, 2026 | hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network | |
| CVE-2026-93599 | Hig | 7.5 | < 1.4.0.1-4.el10_2 | 1.4.0.1-4.el10_2 | Sep 18, 2026 | rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_ | |
| CVE-2026-42784 | Hig | 7.4 | < 1.4.0.1-2.el10_2 | 1.4.0.1-2.el10_2 | Sep 16, 2026 | A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. |
- affected < 1.4.0.1-4.el10_2fixed 1.4.0.1-4.el10_2
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network
- affected < 1.4.0.1-4.el10_2fixed 1.4.0.1-4.el10_2
rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_
- affected < 1.4.0.1-2.el10_2fixed 1.4.0.1-2.el10_2
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check.