UBUNTU-CVE-2026-39984

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint...

Type Confusion

Overview Affected versions of this package are vulnerable to Type Confusion in the TSRESPverifyresponse function. An ASN1TYPE union member is accessed without first validating the type, causing an invalid or null pointer dereference when processing a malformed TimeStamp Response file. An attacker...

CVE-2025-69420

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An...

CVE-2025-69420 Missing ASN1_TYPE validation in TS_RESP_verify_response() function

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An...

EUVD-2025-18798

Malicious code in bioql PyPI...

CVE-2025-52556

rfc3161-client is a Python library implementing the Time-Stamp Protocol TSP described in RFC 3161. Prior to version 1.0.3, there is a flaw in the timestamp response signature verification logic. In particular, chain verification is performed against the TSR's embedded certificates up to the trust...

CVE-2025-52556

CVE-2025-52556 affects the Python library rfc3161-client. Prior to version 1.0.3, the timestamp response signature verification flaw arises because chain verification checks the TSR’s embedded certificates up to trusted roots but does not verify the TSR’s own signature against the timestamping le...

CVE-2025-52556 rfc3161-client has insufficient verification for timestamp response signatures

rfc3161-client is a Python library implementing the Time-Stamp Protocol TSP described in RFC 3161. Prior to version 1.0.3, there is a flaw in the timestamp response signature verification logic. In particular, chain verification is performed against the TSR's embedded certificates up to the trust...