Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.9
Red Hat GnuPG packages could let attackers run code
published 21 days ago
Summary
The GnuPG encryption tools provided by Red Hat (including gnupg2, gnupg2-dirmngr, gnupg2-g13, gnupg2-gpg-agent, and gnupg2-gpgconf) contain a flaw that may allow an attacker to execute unwanted programs on your system. This could compromise the confidentiality and integrity of data processed with these tools. Apply the latest security update from Red Hat as soon as possible to fix the issue.
What to do
- Update redhat gnupg2 to version 0:2.4.9-18.3.hum1.
- Update redhat gnupg2-dirmngr to version 0:2.4.9-18.3.hum1.
- Update redhat gnupg2-g13 to version 0:2.4.9-18.3.hum1.
- Update redhat gnupg2-gpg-agent to version 0:2.4.9-18.3.hum1.
- Update redhat gnupg2-gpgconf to version 0:2.4.9-18.3.hum1.
- Update redhat gnupg2-keyboxd to version 0:2.4.9-18.3.hum1.
- Update redhat gnupg2-scdaemon to version 0:2.4.9-18.3.hum1.
- Update redhat gnupg2-smime to version 0:2.4.9-18.3.hum1.
- Update redhat gnupg2-utils to version 0:2.4.9-18.3.hum1.
- Update redhat gnupg2-verify to version 0:2.4.9-18.3.hum1.
- Update redhat gnupg2-wks to version 0:2.4.9-18.3.hum1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:hummingbird:1 | redhat | gnupg2 |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
| Red Hat:hummingbird:1 | redhat | gnupg2-dirmngr |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
| Red Hat:hummingbird:1 | redhat | gnupg2-g13 |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
| Red Hat:hummingbird:1 | redhat | gnupg2-gpg-agent |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
| Red Hat:hummingbird:1 | redhat | gnupg2-gpgconf |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
| Red Hat:hummingbird:1 | redhat | gnupg2-keyboxd |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
| Red Hat:hummingbird:1 | redhat | gnupg2-scdaemon |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
| Red Hat:hummingbird:1 | redhat | gnupg2-smime |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
| Red Hat:hummingbird:1 | redhat | gnupg2-utils |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
| Red Hat:hummingbird:1 | redhat | gnupg2-verify |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
| Red Hat:hummingbird:1 | redhat | gnupg2-wks |
< 0:2.4.9-18.3.hum1 Fix: upgrade to 0:2.4.9-18.3.hum1
|
Original advisory text
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
References
- https://access.redhat.com/errata/RHSA-2026:82418 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-57062 Third Party Advisory
- https://access.redhat.com/security/updates/classification/ Third Party Advisory
- https://images.redhat.com/ Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82418.... Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2491859 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-57062 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-57062 Vendor Advisory
- https://blog.calif.io/p/how-to-format-a-ciphertext Third Party Advisory
- https://www.gnupg.org/download/ Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Sources
RHSA-2026:82418 · OSV
Track software like this
Free during beta