Upstream information
Description
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding (cross-certification) signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec. 5.2.1.8 and sec. 10.1.3 require the embedded Primary Key Binding signature on any subkey that can issue signatures; it is the subkey's own statement that it belongs to the primary key it is bound under. OpenPGPCertificate resolved the subkey's key flags two different ways. isSigningKey() goes through getKeyFlags() and getApplyingSubpacket(), which falls back to the primary key's direct-key or primary User ID self-signature when the binding signature omits the subpacket, so the subkey inherited the primary's SIGN_DATA and counted as signing-capable; verifyEmbeddedPrimaryKeyBinding(), which enforces the requirement, reads the binding signature's own hashed subpackets, found no SIGN_DATA there, and returned early as a non-signing key without ever demanding the back signature. The same subkey was therefore signing-capable - so its signatures were attributed to the certificate and OpenPGPSignature.OpenPGPDocumentSignature.isValid() returned true - while being exempt from cross-certification, where GnuPG refuses the identical certificate and message. An attacker needs only the victim's public signing subkey, which is public material: they bind it to their own primary key with a Subkey Binding signature they are able to make, carrying no Key Flags and no embedded Primary Key Binding signature, which they cannot make without the subkey's private key, and a relying party verifying one of the victim's genuinely signed messages against that certificate is told the signature is valid and given the attacker's certificate as its issuer. Because a certificate's User IDs are self-asserted, a verifier that pins on the subkey's fingerprint or key ID while taking the identity from the enclosing certificate reports a real signature under an attacker-chosen identity. This is misattribution of a genuine signature rather than forgery of a new one: no private key is recovered, and the signature must be one the grafted subkey actually made. The low-level PGPSignature / PGPPublicKeyRing API performs no binding checks by design and is unaffected. Key Flags are a statement about the key the carrying signature refers to (RFC 9580 sec. 5.2.3.29), so a subkey no longer inherits them from the certificate-wide signatures of the primary key: a Subkey Binding signature that omits the subpacket now leaves the subkey with no capabilities rather than the primary's, which makes the flags the cross-certification check consults the same flags every other decision consults. Preferences and the other subpackets a direct-key signature carries are inherited as before, and the primary key itself, whose flags legitimately come from its own direct-key or User ID self-signature, is unaffected.SUSE information
Overall state of this security issue: Pending
This issue is currently rated as having moderate severity.
| CVSS detail | SUSE |
|---|---|
| Base Score | 5.9 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Attack Vector | Network |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | None |
| Integrity Impact | High |
| Availability Impact | None |
| CVSSv3 Version | 3.1 |
| CVSS detail | CNA (91579145-5d7b-4cc5-b925-a0262ff19630) | SUSE |
|---|---|---|
| Base Score | 8.2 | 8.2 |
| Vector | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| Attack Vector | Network | Network |
| Attack Complexity | Low | Low |
| Attack Requirements | Present | Present |
| Privileges Required | None | None |
| User Interaction | None | None |
| Vulnerable System Confidentiality Impact | None | None |
| Vulnerable System Integrity Impact | High | High |
| Vulnerable System Availability Impact | None | None |
| Subsequent System Confidentiality Impact | None | None |
| Subsequent System Integrity Impact | None | None |
| Subsequent System Availability Impact | None | None |
| CVSSv4 Version | 4.0 | 4.0 |
Status of this issue by product and package
Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification. The updates are grouped by state of their lifecycle. SUSE product lifecycles are documented on the lifecycle page.
| Product(s) | Source package | State |
|---|---|---|
| Products under general support and receiving all security fixes. | ||
| SUSE Linux Enterprise Desktop 15 SP7 | bouncycastle | Affected |
| SUSE Linux Enterprise Module for Development Tools 15 SP7 | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP7 | bouncycastle | Affected |
| SUSE Linux Enterprise Server 16.0 | bouncycastle | Affected |
| SUSE Linux Enterprise Server 16.1 | bouncycastle | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | bouncycastle | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | bouncycastle | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | bouncycastle | Affected |
| openSUSE Leap 16.0 | bouncycastle | Affected |
| Products under Long Term Service Pack support and receiving important and critical security fixes. | ||
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5 | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | bouncycastle | Affected |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | bouncycastle | Affected |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | bouncycastle | Affected |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP4 | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP4-LTSS | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP5 | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP5-LTSS | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP6 | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | bouncycastle | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | bouncycastle | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | bouncycastle | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | bouncycastle | Affected |
| Products past their end of life and not receiving proactive updates anymore. | ||
| SUSE Enterprise Storage 7 | bouncycastle | Affected |
| SUSE Enterprise Storage 7.1 | bouncycastle | Affected |
| SUSE Linux Enterprise Desktop 15 SP2 | bouncycastle | Affected |
| SUSE Linux Enterprise Desktop 15 SP3 | bouncycastle | Affected |
| SUSE Linux Enterprise Desktop 15 SP4 | bouncycastle | Affected |
| SUSE Linux Enterprise Desktop 15 SP5 | bouncycastle | Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP2 | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP3 | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4 | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | bouncycastle | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | bouncycastle | Affected |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | bouncycastle | Affected |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | bouncycastle | Affected |
| SUSE Linux Enterprise Real Time 15 SP2 | bouncycastle | Affected |
| SUSE Linux Enterprise Real Time 15 SP3 | bouncycastle | Affected |
| SUSE Linux Enterprise Real Time 15 SP4 | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP2 | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP2-BCL | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP2-LTSS | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP3 | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP3-BCL | bouncycastle | Affected |
| SUSE Linux Enterprise Server 15 SP3-LTSS | bouncycastle | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | bouncycastle | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | bouncycastle | Affected |
| SUSE Manager Proxy 4.1 | bouncycastle | Affected |
| SUSE Manager Proxy 4.2 | bouncycastle | Affected |
| SUSE Manager Proxy 4.3 | bouncycastle | Affected |
| SUSE Manager Retail Branch Server 4.1 | bouncycastle | Affected |
| SUSE Manager Retail Branch Server 4.2 | bouncycastle | Affected |
| SUSE Manager Retail Branch Server 4.3 | bouncycastle | Affected |
| SUSE Manager Server 4.1 | bouncycastle | Affected |
| SUSE Manager Server 4.2 | bouncycastle | Affected |
| SUSE Manager Server 4.3 | bouncycastle | Affected |
| openSUSE Leap 15.3 | bouncycastle | Affected |
| openSUSE Leap 15.4 | bouncycastle | Affected |
| openSUSE Leap 15.5 | bouncycastle | Affected |
| openSUSE Leap 15.6 | bouncycastle | Affected |
| Products at an unknown state of their lifecycle. | ||
| SUSE Linux Enterprise Server for NVIDIA 16.1 | bouncycastle | Affected |
| Container Status | ||
| containers/apache-pulsar:3.3 | bouncycastle | Affected |
SUSE Timeline for this CVE
CVE page created: Mon Oct 5 15:42:43 2026CVE page last modified: Wed Oct 7 20:03:32 2026