Threats Tagged 'cve-2026-41506'

CVE-2026-1229 is a low-severity vulnerability in the Cloudflare CIRCL library affecting the CombinedMult function in the ecc/p384 package for the secp384r1 curve. The function produces incorrect values for certain inputs due to incomplete addition formulas. This issue does not affect ECDH or ECDSA operations relying on this curve. The vulnerability was fixed in version 1.6.3 of CIRCL.

This update includes the following RPMs: trivy: * trivy-0.72.0-0.1.hum1 (aarch64, x86_64) * trivy-0.72.0-0.1.hum1.src (src) Security Fix(es): trivy: * CVE-2026-46680 * CVE-2026-47262 * CVE-2026-53488

This security update for git-bug addresses two vulnerabilities: CVE-2026-1229, involving an incorrect calculation in the secp384r1 CombinedMult function in the CIRCL library, and CVE-2026-41506, which causes HTTP authentication credentials to leak when following redirects during smart-HTTP clone and fetch operations. The update includes upgrading dependencies to fixed versions to resolve these issues.

This security update for the Trivy tool addresses multiple vulnerabilities across various third-party dependencies, including denial of service, open redirect, improper data integrity verification, authorization bypass, directory traversal, and credential leakage issues. The update includes upgrading the go-git dependency to version 5.18.0 and Trivy itself to version 0.70.0.

This update includes the following RPMs: syft: * syft-1.44.0-0.3.hum1 (aarch64, x86_64) * syft-1.44.0-0.3.hum1.src (src)

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144) * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.