RHSA-2026:37268HighCVSS 8.8

Red Hat Security Advisory: RHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release

Published
July 9, 2026
Last Modified
September 29, 2026

🔗 CVE IDs covered (4)

CVE-2026-39830 →CVE-2026-39835 →CVE-2026-39828 →CVE-2026-39829 →

📋 Description

CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate

🎯 Affected products3

  • Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/ctlog-monitor-rhel9@sha256:4502f26fff1b13763ddb7a6cc66a81cab407589b75409b2c5455c12bc2643517_amd64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/rekor-monitor-rhel9@sha256:3d551907e5a5b7fe8ca110d273a02f60296dbc3ca512af3a80715e9cfc4477e8_amd64 as a component of Red Hat Trusted Artifact Signer 1.4

✅ Remediation

Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.

🔗 References (9)