{"id":"UBUNTU-CVE-2026-47191","details":"kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the referenced repository has been taken over by an attacker and modified to carry such a branch. SHA-1 commits may also be replaced by creating hash collisions, so the primary impact of this issue is on SHA-256 commit IDs. Version 5.3 fixes the issue. As a workaround, avoid relying solely on the commit ID for integrity validation of a repository that might become under control of a malicious 3rd party. If available, additional validate cryptographically signed commits or tags. Alternatively, mirror the repository to a save place, validate its integrity, and use this instead of the original one.","modified":"2026-08-19T13:31:54.449415369Z","published":"2026-08-14T17:18:00Z","upstream":["CVE-2026-47191"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-47191"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-47191"},{"type":"REPORT","url":"https://github.com/siemens/kas/security/advisories/GHSA-qjwp-hrq6-r26r"},{"type":"REPORT","url":"https://github.com/siemens/kas/commit/4cb4a3d01122ffaec9feaae768a5814092f6f9b5"}],"affected":[{"package":{"name":"kas","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/kas?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.3-2","2.5-1","2.6.3-2"],"ecosystem_specific":{"binaries":[{"binary_name":"kas","binary_version":"2.6.3-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47191.json"}},{"package":{"name":"kas","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/kas?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"kas","binary_version":"4.0-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47191.json"}},{"package":{"name":"kas","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/kas?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7-1","4.8.1-1","4.8.1-2"],"ecosystem_specific":{"binaries":[{"binary_name":"kas","binary_version":"4.8.1-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47191.json"}},{"package":{"name":"kas","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/kas?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-2","5.0-1","5.1-1"],"ecosystem_specific":{"binaries":[{"binary_name":"kas","binary_version":"5.1-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47191.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}