Skip to content
OpenAdvisories
Medium ELSA-2026-26352 1 CVE

Moderate: opencryptoki security update (Oracle Linux 8)

Published Jun 16, 2026 · Updated Jun 16, 2026

Ecosystem: Oracle Linux

Summary

[3.22.0-3.3]
- Resolves: RHEL-171558, Fix possible out-of-bounds access in BER decode functions

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 8 opencryptoki 0:3.22.0-3.el8_10.3
Oracle Linux · 8 opencryptoki-devel 0:3.22.0-3.el8_10.3
Oracle Linux · 8 opencryptoki-icsftok 0:3.22.0-3.el8_10.3
Oracle Linux · 8 opencryptoki-libs 0:3.22.0-3.el8_10.3
Oracle Linux · 8 opencryptoki-swtok 0:3.22.0-3.el8_10.3
Oracle Linux · 8 opencryptoki-tpmtok 0:3.22.0-3.el8_10.3

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-40253

    openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c

    openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER…

    opencryptoki opencryptoki opencryptoki opencryptoki Debian Ubuntu Azure Linux