cve-2026-75939

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75939.json"
      }
    ],
    "title": "openshift/oc-mirror: Release signature verification: OpenPGP SignatureError checked before signed body is consumed",
    "tracking": {
      "current_release_date": "2026-09-22T22:14:21+00:00",
      "generator": {
        "date": "2026-09-22T22:14:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "CVE-2026-75939",
      "initial_release_date": "2026-09-21T13:27:53.361000+00:00",
      "revision_history": [
        {
          "date": "2026-09-21T13:27:53.361000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-22T21:07:28+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-09-22T22:14:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4",
                  "product_id": "red_hat_openshift_container_platform_4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Container Platform 4"
          },
          {
            "category": "product_version",
            "name": "openshift4/oc-mirror-plugin-rhel8",
            "product": {
              "name": "openshift4/oc-mirror-plugin-rhel8",
              "product_id": "openshift4/oc-mirror-plugin-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/oc-mirror-plugin-rhel8?repository_url=registry.redhat.io/openshift4/oc-mirror-plugin-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "openshift4/oc-mirror-plugin-rhel9",
            "product": {
              "name": "openshift4/oc-mirror-plugin-rhel9",
              "product_id": "openshift4/oc-mirror-plugin-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/oc-mirror-plugin-rhel9?repository_url=registry.redhat.io/openshift4/oc-mirror-plugin-rhel9"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/oc-mirror-plugin-rhel8 as a component of Red Hat OpenShift Container Platform 4",
          "product_id": "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel8"
        },
        "product_reference": "openshift4/oc-mirror-plugin-rhel8",
        "relates_to_product_reference": "red_hat_openshift_container_platform_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/oc-mirror-plugin-rhel9 as a component of Red Hat OpenShift Container Platform 4",
          "product_id": "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel9"
        },
        "product_reference": "openshift4/oc-mirror-plugin-rhel9",
        "relates_to_product_reference": "red_hat_openshift_container_platform_4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-75939",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-07-17T00:00:00+00:00",
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel8"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517976"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openshift/oc-mirror: Release signature verification: OpenPGP SignatureError checked before signed body is consumed",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in `oc-mirror` allows an attacker to bypass release image signature verification. By intercepting the signature endpoint, an adversary can forge PGP messages with a known Red Hat release key ID, leading `oc-mirror` to accept and mirror malicious payloads into disconnected OpenShift registries. This poses a significant risk to the integrity of software deployed in disconnected environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel9"
        ],
        "known_not_affected": [
          "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75939"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517976",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517976"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75939",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75939"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75939",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75939"
        }
      ],
      "release_date": "2026-09-21T13:27:53.361000+00:00",
      "remediations": [
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel9"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel9"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel8",
            "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel8",
            "red_hat_openshift_container_platform_4:openshift4/oc-mirror-plugin-rhel9"
          ]
        }
      ],
      "title": "openshift/oc-mirror: Release signature verification: OpenPGP SignatureError checked before signed body is consumed"
    }
  ]
}