Threats affecting pkg:github/siemens/kas

CVE-2026-47192 is a medium severity vulnerability in Siemens kas, a setup tool for bitbake-based projects. Versions from 4.8 up to but not including 5.3 improperly verify cryptographic signatures by processing repositories before validating their signatures. Under specific conditions involving repository control, configuration includes, and key management, an attacker could replace a legitimate repository with a malicious one. The issue is fixed in kas version 5.3. A workaround involves pinning the expected signature key via its fingerprint.

CVE-2026-47191 is a vulnerability in Siemens kas, a setup tool for bitbake-based projects, affecting versions prior to 5.3. The issue involves improper verification of cryptographic signatures when relying solely on git commit IDs (SHA-1 or SHA-256) to validate repository state. This can allow an attacker who controls the repository to trick users into checking out malicious branches with the same name. The vulnerability primarily impacts SHA-256 commit IDs due to the possibility of hash collisions with SHA-1. Version 5.3 addresses this issue. Workarounds include avoiding sole reliance on commit IDs, validating cryptographically signed commits or tags, or using mirrored repositories with verified integrity.