4 CVE-2026-2625

Enriched by CISA
 

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
https://nvd.nist.gov/vuln/detail/CVE-2026-2625

Categories

CWE-347 : Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) Does not properly verify signatures for "trusted" entities. Insufficient verification allows spoofing. Insufficient verification allows spoofing. Accepts a configuration file without a Message Integrity Check (MIC) signature.

References


 

AFFECTED (from MITRE)

Vendor Product Versions
Red Hat Red Hat Enterprise Linux 10
    Red Hat Red Hat Enterprise Linux 9
      Red Hat Red Hat Hardened Images 1
        © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

        CPE

        cpe start end

        REMEDIATION


        EXPLOITS

        Exploit-db.com

        id description date
        No known exploits

        POC Github

        Url
        No known exploits

        Other Nist (github, ...)

        Url
        No known exploits

        CAPEC

        Common Attack Pattern Enumerations and Classifications

        id description severity
        463 Padding Oracle Crypto Attack
        		High
        475 Signature Spoofing by Improper Validation
        		High