Skip to content
OpenAdvisories
Medium ELSA-2026-5587 1 CVE

Moderate: opencryptoki security update (Oracle Linux 8)

Published Mar 24, 2026 · Updated Mar 24, 2026

Ecosystem: Oracle Linux

Summary

[3.22.0-3.2]
- Resolves: RHEL-144817, CVE-2026-23893 Privilege Escalation or Data Exposure via Symlink Following

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 8 opencryptoki 0:3.22.0-3.el8_10.2
Oracle Linux · 8 opencryptoki-devel 0:3.22.0-3.el8_10.2
Oracle Linux · 8 opencryptoki-icsftok 0:3.22.0-3.el8_10.2
Oracle Linux · 8 opencryptoki-libs 0:3.22.0-3.el8_10.2
Oracle Linux · 8 opencryptoki-swtok 0:3.22.0-3.el8_10.2
Oracle Linux · 8 opencryptoki-tpmtok 0:3.22.0-3.el8_10.2

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-23893

    openCryptoki has improper link resolution before file access (link following)

    openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by plan…

    opencryptoki opencryptoki opencryptoki opencryptoki Debian Ubuntu Azure Linux