Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products6

• Red Hat Trusted Artifact Signer 1.3
• registry.redhat.io/rhtas/cosign-rhel9@sha256:f9d294f471bbc51b5976ba9bb3c8f9de1e7beb8e1c1fce97ceff62a56a07117b_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
• registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:635cb9d30a7345717f644283c547a8b58e5bab0b8014f957df4372538fd34d24_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
• registry.redhat.io/rhtas/gitsign-rhel9@sha256:35bdbe7f2c6491fd76c4f43859bb2ae00d5745354252cfa0cbb876f2b622397e_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
• registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:3ce805dde5d4d1fd032da880e341cd3fbbcf6e6b797ff76f7411b945e8de3052_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
• registry.redhat.io/rhtas/updatetree-rhel9@sha256:f7d4ea889bb616b31c26a5f13fb1d2769898c27ee1540c7d8fb5d67db842008f_amd64 as a component of Red Hat Trusted Artifact Signer 1.3

✅ Remediation

Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index

🔗 References (6)

• selfhttps://access.redhat.com/errata/RHSA-2026:59433
• externalhttps://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3
• externalhttps://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index
• externalhttps://access.redhat.com/security/cve/CVE-2025-47907
• externalhttps://access.redhat.com/security/updates/classification/
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59433.json