21 matches found
CVE-2026-71887
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...
DEBIAN-CVE-2026-71887
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...
UBUNTU-CVE-2026-71887
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...
CVE-2026-71887
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...
EUVD-2026-91993
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...
CVE-2026-71887 OpenPGP data signature accepted from a signing subkey without cross-certification
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...
CVE-2026-71887
The Bouncy Castle for Java high-level OpenPGP API (versions before 1.86 ) contains a vulnerability where it accepts data signatures from signing subkeys that lack a required embedded Primary Key Binding signature when the Key Flags subpacket is omitted. The flaw stems from inconsistent logic in O...
CVE-2026-71887: Improper Verification of Cryptographic Signature
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...
PT-2026-104560
Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description The high-level OpenPGP API incorrectly accepts data signatures from a signing subkey when the Subkey Binding signature lacks an embedded Primary Key Binding cross-certification signatur...
CLSA-2026-1777545003 rpm: Fix of CVE-2021-3521
CVE-2021-3521: validate and require subkey binding signatures on PGP public keys...
CLSA-2026-1777539405 rpm: Fix of CVE-2021-3521
CVE-2021-3521: validate and require subkey binding signatures on PGP public keys...
CLSA-2026-1777539108 rpm: Fix of CVE-2021-3521
CVE-2021-3521: validate and require subkey binding signatures on PGP public keys...
Security update for rpm
This update for rpm fixes the following issues: Security fixes: - CVE-2021-3521: Fixed missing subkey binding signature checking bsc1191175 Other fixes: accept more signature subpackets marked as critical bsc1218686 backport limit support for the autopatch macro bsc1189495 Patch Instructions: To...
Security update for rpm
This update for rpm fixes the following issues: Security fixes: - CVE-2021-3521: Fixed missing subkey binding signature checking bsc1191175 Other fixes: accept more signature subpackets marked as critical bsc1218686 backport limit support for the autopatch macro bsc1189495 Patch Instructions: To...
Security update for rpm
This update for rpm fixes the following issues: Security fixes: - CVE-2021-3521: Fixed missing subkey binding signature checking bsc1191175 Other fixes: accept more signature subpackets marked as critical bsc1218686 backport limit support for the autopatch macro bsc1189495 Patch Instructions: To...
SUSE-SU-2024:1557-1 Security update for rpm
This update for rpm fixes the following issues: Security fixes: - CVE-2021-3521: Fixed missing subkey binding signature checking bsc1191175 Other fixes: - accept more signature subpackets marked as critical bsc1218686 - backport limit support for the autopatch macro bsc1189495...
Updated rpm packages fix security vulnerability
RPM does not require subkeys to have a valid binding signature CVE-2021-3521...
rpm4 -- Multiple Vulnerabilities
rpm project reports: Fix intermediate symlinks not verified CVE-2021-35939. Fix subkey binding signatures not checked on PGP public keys CVE-2021-3521. Refactor file and directory operations to use fd-based APIs throughout CVE-2021-35938...
rpm: RPM does not require subkeys to have a valid binding signature
There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature."1 RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey t...
