Summary
[3.25.0-5.2]
- Resolves: RHEL-144815, Privilege Escalation or Data Exposure via Symlink Following
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | opencryptoki | 0:3.25.0-5.el10_1.2 |
| Oracle Linux · 10 | opencryptoki-ccatok | 0:3.25.0-5.el10_1.2 |
| Oracle Linux · 10 | opencryptoki-devel | 0:3.25.0-5.el10_1.2 |
| Oracle Linux · 10 | opencryptoki-icsftok | 0:3.25.0-5.el10_1.2 |
| Oracle Linux · 10 | opencryptoki-libs | 0:3.25.0-5.el10_1.2 |
| Oracle Linux · 10 | opencryptoki-swtok | 0:3.25.0-5.el10_1.2 |
Vulnerabilities 1
-
Medium 6.8
openCryptoki has improper link resolution before file access (link following)
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by plan…