RHSA-2026:83597HighCVSS 7.5

Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release

Published
October 15, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (5)

CVE-2026-71556 →CVE-2026-73500 →CVE-2026-84445 →CVE-2026-41178 →CVE-2026-56854 →

📋 Description

CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-56854 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution CVE-2026-73500 — etcd: etcd: Denial of Service via unbounded TLS handshake goroutines CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

🎯 Affected products21

  • Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/cosign-rhel9@sha256:1125b9898d1a3165fba2c96b143e63e3f8919f2d91cedf7f6899566d394b09c5_s390x as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/cosign-rhel9@sha256:44f0c5a3ee95b60e098f1a0733d9d366a169eb076fc6fe945e7a7baa1bc3ea3a_amd64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/cosign-rhel9@sha256:b71496adedc9117419b4209aea3ae17f042d6e36f6a8ff25cd4b56649b0aed30_arm64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/cosign-rhel9@sha256:f7019515c53440f22ebe3340c8905fed2805ac2cd1d4022b5c5c03b39d4d1877_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:1f3293c5a27d2b700a3e23ef13c24b1a15430044c4fab59424e86e37daded7e2_amd64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:3659e338589692444a712f36e6c5113502ef7704ece0069ee7c39d59ab7c9c5c_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b91463128ac80dfde938a8bebe3622e7851c71845c0460130803d9ad413371a2_arm64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:fd290c9b45fee3033695938c37c4bb9da0d4187cfca69ac38e0c2f2b4a2ea795_s390x as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/gitsign-rhel9@sha256:2c7eeb52e1d3e6ed08517fc59aedae9586abafceb704917d8b287f123a1872a3_amd64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/gitsign-rhel9@sha256:a157004db3bc40a7950e0497eb68de33b6487432bd21401b79ac8241caf91718_arm64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/gitsign-rhel9@sha256:c966b927c8a79651ad43b65f4db3f973ceb0d1fb2b16f9b3be664386980134da_s390x as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/gitsign-rhel9@sha256:f4dd8d1a262bb52a6b2820688722b481c6f937fe5b4e195c1373b663fa92ed41_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:4f80195221738a5ffdc3f56d221d21ba7e0a2a12fa8fca56a78f410fdc085673_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:6e9d9541f521b1eeab96f2dbad1c8784cfe8c6a58d8821033ecd882eefe22a57_s390x as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:7b028accad081f780ad02d4edd45863cbb889eee58e7d58d809e324b58fe27e8_arm64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:dc15abc35d9bca838ea759844b807f427d545acc5c91c89007b5bb1507574617_amd64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/updatetree-rhel9@sha256:15bdaaf88059eae0c63c812671becb209f9c5933bb76feb050bcee8b211b934c_s390x as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/updatetree-rhel9@sha256:1b5ad5a8f7340144a258850e2355cc50e00c6ca02f3a00b408e32c3cb37e625d_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/updatetree-rhel9@sha256:def61139f02a70a2208bf9e32c06d3ca447c56d2697ed50a3291022c0ae5a53f_arm64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/updatetree-rhel9@sha256:fce239ee2f73cbf5b697fafbfa07f5432b81cc9fdcc4ab786be984744172516f_amd64 as a component of Red Hat Trusted Artifact Signer 1.4

✅ Remediation

Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later). Workaround: Restrict network access to the etcd TLS listener to only trusted clients and networks. Configure firewall rules to limit inbound connections to the etcd client port (default 2379) and peer port (default 2380) to authorized hosts. This reduces the attack surface by preventing untrusted network attackers from reaching the vulnerable service.

🔗 References (10)