VDB
RHSA-2026%3A6912
RHSA-2026%3A6912
PUBLISHED
CVSS 9.100000381469727 CRITICAL
A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 as a component of Red Hat Quay 3.1 | *, registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64, registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64, *, registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x, registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x, * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le as a component of Red Hat Quay 3.1 | *, registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le, registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64 as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64, registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64, * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x, *, registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x |
| Red Hat | registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x, *, registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 as a component of Red Hat Quay 3.1 | * |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x as a component of Red Hat Quay 3.1 | *, registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x, registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 as a component of Red Hat Quay 3.1 | *, *, registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64 as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64, registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64, * |
| Red Hat | registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le as a component of Red Hat Quay 3.1 | *, registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le, registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x as a component of Red Hat Quay 3.1 | registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x |
…and 12 more
Timeline
- Apr 7, 2026 CVE Published
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:6912 advisory
- https://access.redhat.com/security/cve/CVE-2026-28498 advisory
- https://access.redhat.com/security/cve/CVE-2026-30922 advisory
- https://access.redhat.com/security/cve/CVE-2026-32597 advisory
- https://access.redhat.com/security/cve/CVE-2026-4599 advisory
- https://access.redhat.com/security/cve/CVE-2026-4600 advisory
- https://access.redhat.com/security/cve/CVE-2026-4601 advisory
- https://access.redhat.com/security/cve/CVE-2026-4602 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6912.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2450207 issue
- https://www.cve.org/CVERecord?id=CVE-2026-4599 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-4599 advisory
- https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20 advisory
- https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1 advisory
- https://github.com/kjur/jsrsasign/pull/647 advisory
- https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2450208 issue
- https://www.cve.org/CVERecord?id=CVE-2026-4600 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-4600 advisory
…and 33 more