RHSA-2026:98248: Important: rust-rpm-sequoia security update
An implementation of the RPM PGP interface using Sequoia.Security Fix(es): sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Other sources
Important: rust-rpm-sequoia security update
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rust-rpm-sequoiato a version that resolves this vulnerability.Fixed in 1.6.0-6.el10_0.7 - Upgrade
Upgrade
redhat/rpm-sequoiato a version that resolves this vulnerability.Fixed in 1.6.0-6.el10_0.7 - Upgrade
Upgrade
redhat/rpm-sequoia-debuginfoto a version that resolves this vulnerability.Fixed in 1.6.0-6.el10_0.7 - Upgrade
Upgrade
redhat/rust-rpm-sequoia-debugsourceto a version that resolves this vulnerability.Fixed in 1.6.0-6.el10_0.7 - Upgrade
Upgrade
redhat/rpm-sequoiato a version that resolves this vulnerability.Fixed in 1.6.0-6.el10_0.7.aa - Upgrade
Upgrade
redhat/rpm-sequoia-debuginfoto a version that resolves this vulnerability.Fixed in 1.6.0-6.el10_0.7.aa - Upgrade
Upgrade
redhat/rust-rpm-sequoia-debugsourceto a version that resolves this vulnerability.Fixed in 1.6.0-6.el10_0.7.aa
Event History
Frequently Asked Questions
Which systems should be prioritized for this update?
Prioritize Red Hat Enterprise Linux systems using rpm-sequoia on ARM 64, x86_64, IBM z Systems, or Power little-endian platforms covered by the listed 4-year support or Extended Update Support offerings. The advisory also lists rpm-sequoia-debuginfo and rust-rpm-sequoia-debugsource packages.
What security issue does this update address?
It addresses CVE-2026-42784 in sequoia-openpgp, described as a cryptographic integrity compromise caused by key flag confusion. The provided advisory data does not specify exploitation prerequisites, affected configurations, or compensating controls.