AZL-112501: CVE-2026-118782 affecting package python-tensorboard 2.16.2-6

Q: Which deployments are exposed to exploitation?

Deployments are exposed if they process attacker-controlled PKCS#12 or PKCS#8 encrypted private-key input through the affected Forge APIs. The relevant paths include forge.pkcs12.pkcs12FromAsn1() and forge.pki.decryptPrivateKeyInfo() when legacy PKCS#12 PBE algorithms are used.

Q: What must an attacker provide to bypass the integrity check?

An attacker needs crafted PKCS#12 input with a MAC or password-based encryption iteration count of zero or less. In affected versions, this causes key generation to return a constant value independent of the password and salt.

Q: Are all encrypted PKCS#12 and private-key inputs affected?

No. The issue affects legacy PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags and encrypted SafeContents. PBES2/PBKDF2-encrypted content is unaffected.

Q: What is the available remediation?

Update Forge to version 1.4.1, which fixes the issue. If updating is not immediately possible, avoid processing untrusted PKCS#12 or PKCS#8 encrypted private-key material using the affected legacy PBE schemes.

Published Oct 29, 2026

Updated

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1.

Affected Software

1 affected component

azure-linux/python-tensorboard<=2.16.2-6

Event History

Oct 29, 2026

Advisory Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118782

Frequently Asked Questions

Which deployments are exposed to exploitation?

Deployments are exposed if they process attacker-controlled PKCS#12 or PKCS#8 encrypted private-key input through the affected Forge APIs. The relevant paths include forge.pkcs12.pkcs12FromAsn1() and forge.pki.decryptPrivateKeyInfo() when legacy PKCS#12 PBE algorithms are used.

What must an attacker provide to bypass the integrity check?

An attacker needs crafted PKCS#12 input with a MAC or password-based encryption iteration count of zero or less. In affected versions, this causes key generation to return a constant value independent of the password and salt.

Are all encrypted PKCS#12 and private-key inputs affected?

No. The issue affects legacy PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags and encrypted SafeContents. PBES2/PBKDF2-encrypted content is unaffected.

What is the available remediation?

Update Forge to version 1.4.1, which fixes the issue. If updating is not immediately possible, avoid processing untrusted PKCS#12 or PKCS#8 encrypted private-key material using the affected legacy PBE schemes.

AZL-112501: CVE-2026-118782 affecting package python-tensorboard 2.16.2-6

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to exploitation?

What must an attacker provide to bypass the integrity check?

Are all encrypted PKCS#12 and private-key inputs affected?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to exploitation?

What must an attacker provide to bypass the integrity check?

Are all encrypted PKCS#12 and private-key inputs affected?

What is the available remediation?