PT-2026-104568
CVE-2026-71886
·
تاريخ النشر
2026-10-03
·
تاريخ التحديث
2026-10-26
الوصف من
CVSS 4.0
8.2
عاليةالمقاييسAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Name of the Vulnerable Software and Affected Versions
Bouncy Castle for Java versions prior to 1.86
Description
The high-level OpenPGP certificate API fails to verify if a component key of an issuing certificate has the required authority to certify when processing third-party certifications or trust delegations. Specifically, the functions
getCertificationBy() and getDelegationBy() in the OpenPGPCertificate class verify the signature and binding chain but do not check for the CERTIFY OTHER key flag as required by RFC 9580. This allows a restricted subkey, such as one bound only for SIGN DATA or encryption, to issue a valid User ID certification or a direct-key delegation of trust. Consequently, an application may incorrectly attribute an attacker's assertion to the offline primary key, bypassing the security containment intended by key-flag separation.Recommendations
Update Bouncy Castle for Java to version 1.86 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾