VDB
RHSA-2026:67319
RHSA-2026:67319
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | git-lfs-debugsource-0:3.2.0-2.el9_2.10.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-debuginfo-0:3.2.0-2.el9_2.10.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-debugsource-0:3.2.0-2.el9_2.10.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-debuginfo-0:3.2.0-2.el9_2.10.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-0:3.2.0-2.el9_2.10.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-debugsource-0:3.2.0-2.el9_2.10.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-0:3.2.0-2.el9_2.10.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-debuginfo-0:3.2.0-2.el9_2.10.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-0:3.2.0-2.el9_2.10.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-0:3.2.0-2.el9_2.10.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-debuginfo-0:3.2.0-2.el9_2.10.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-debugsource-0:3.2.0-2.el9_2.10.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
| Red Hat | git-lfs-0:3.2.0-2.el9_2.10.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 3.2.0-2.el9 |
Timeline
- Sep 14, 2026 CVE Published
- Sep 23, 2026 CVE Updated
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:67319 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2437111 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456333 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456336 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456338 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456339 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515815 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515820 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515839 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515840 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67319.json advisory
- https://access.redhat.com/security/cve/CVE-2025-68121 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-68121 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-68121 advisory
- https://go.dev/cl/737700 advisory
- https://go.dev/issue/77217 advisory
- https://groups.google.com/g/golang-announce/c/K09ubi9FQFk advisory
…and 65 more