VDB
RHSA-2026:86992
RHSA-2026:86992
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | git-sync-0:4.7.1-0.3.hum1@aarch64 as a component of Red Hat Hardened Images | 4.7.1-0.3.hum1 |
| Red Hat | git-sync-0:4.7.1-0.3.hum1@s390x as a component of Red Hat Hardened Images | 4.7.1-0.3.hum1 |
| Red Hat | git-sync-0:4.7.1-0.3.hum1@x86_64 as a component of Red Hat Hardened Images | 4.7.1-0.3.hum1 |
| Red Hat | git-sync-0:4.7.1-0.3.hum1@src as a component of Red Hat Hardened Images | 4.7.1-0.3.hum1 |
Timeline
- Oct 21, 2026 CVE Published
- Oct 22, 2026 CVE Updated
- Oct 22, 2026 Distribution Patch
- Oct 22, 2026 Distribution Patch
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:86992 advisory
- https://access.redhat.com/security/cve/CVE-2026-111943 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://images.redhat.com/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86992.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2556068 issue
- https://access.redhat.com/security/vulnerabilities/RHSB-2026-012 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-111943 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-111943 advisory
- https://github.com/golang/go/issues/82345 advisory
- https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU advisory