Summary
The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System.
Security Fix(es):
* pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | idm-jss | 4.11.0-1.module_el8.10.0+3801+17b19a60 |
| AlmaLinux · 8 | idm-jss-javadoc | 4.11.0-1.module_el8.10.0+3801+17b19a60 |
| AlmaLinux · 8 | idm-ldapjdk | 4.24.0-1.module_el8.10.0+3801+17b19a60 |
| AlmaLinux · 8 | idm-ldapjdk-javadoc | 4.24.0-1.module_el8.10.0+3801+17b19a60 |
| AlmaLinux · 8 | idm-pki-acme | 10.15.1-3.module_el8.10.0+4298+2330dc61 |
| AlmaLinux · 8 | idm-pki-base | 10.15.1-3.module_el8.10.0+4298+2330dc61 |
| AlmaLinux · 8 | idm-pki-base-java | 10.15.1-3.module_el8.10.0+4298+2330dc61 |
| AlmaLinux · 8 | idm-pki-ca | 10.15.1-3.module_el8.10.0+4298+2330dc61 |
| AlmaLinux · 8 | idm-pki-kra | 10.15.1-3.module_el8.10.0+4298+2330dc61 |
| AlmaLinux · 8 | idm-pki-server | 10.15.1-3.module_el8.10.0+4298+2330dc61 |
| AlmaLinux · 8 | idm-pki-symkey | 10.15.1-3.module_el8.10.0+4298+2330dc61 |
| AlmaLinux · 8 | idm-pki-tools | 10.15.1-3.module_el8.10.0+4298+2330dc61 |
| AlmaLinux · 8 | idm-tomcatjss | 7.8.0-1.module_el8.10.0+3801+17b19a60 |
| AlmaLinux · 8 | python3-idm-pki | 10.15.1-3.module_el8.10.0+4298+2330dc61 |
| AlmaLinux · 8 | resteasy | 3.0.26-7.module_el8.10.0+4273+d9f1a83b |
| AlmaLinux · 8 | resteasy-javadoc | 3.0.26-7.module_el8.10.0+4273+d9f1a83b |
Vulnerabilities 1
-
High 7.2
Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges c…