RHSA-2026:59439HighCVSS 7.5

Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

Published
August 25, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (5)

CVE-2024-9355 →CVE-2025-7783 →CVE-2025-47907 →CVE-2026-48702 →CVE-2026-59869 →

📋 Description

CVE-2024-9355 — golang-fips: Golang FIPS zeroed buffer CVE-2025-7783 — form-data: Unsafe random function in form-data CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2026-48702 — github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents

🎯 Affected products11

  • Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64 as a component of Red Hat Trusted Artifact Signer 1.3

✅ Remediation

Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: There is no effective workaround. Setting max_request_body_size reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting max_apk_metadata_size has no effect on this vulnerability since the check is applied after decompression. Upgrade to Rekor 1.5.2 or later. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.

🔗 References (10)