Skip to content
OpenAdvisories
Medium ELSA-2026-28231 1 CVE

Moderate: opencryptoki security update (Oracle Linux 10)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[3.26.0-3.1]
- Resolves: RHEL-171556, Fix possible out-of-bounds access in BER decode functions

[3.26.0-3]
- Resolves: RHEL-169565, Fix syslog message printing about different CPs

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 10 opencryptoki 0:3.26.0-3.el10_2.1
Oracle Linux · 10 opencryptoki-ccatok 0:3.26.0-3.el10_2.1
Oracle Linux · 10 opencryptoki-devel 0:3.26.0-3.el10_2.1
Oracle Linux · 10 opencryptoki-icsftok 0:3.26.0-3.el10_2.1
Oracle Linux · 10 opencryptoki-libs 0:3.26.0-3.el10_2.1
Oracle Linux · 10 opencryptoki-swtok 0:3.26.0-3.el10_2.1

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-40253

    openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c

    openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER…

    opencryptoki opencryptoki opencryptoki opencryptoki Debian Ubuntu Azure Linux