Skip to content
OpenAdvisories
Medium ELSA-2026-5603 1 CVE

Moderate: opencryptoki security update (Oracle Linux 9)

Published Mar 24, 2026 · Updated Mar 24, 2026

Ecosystem: Oracle Linux

Summary

[3.25.0-4.2]
- Resolves: RHEL-144820, Privilege Escalation or Data Exposure via Symlink Following

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 9 opencryptoki 0:3.25.0-4.el9_7.2
Oracle Linux · 9 opencryptoki-ccatok 0:3.25.0-4.el9_7.2
Oracle Linux · 9 opencryptoki-devel 0:3.25.0-4.el9_7.2
Oracle Linux · 9 opencryptoki-icsftok 0:3.25.0-4.el9_7.2
Oracle Linux · 9 opencryptoki-libs 0:3.25.0-4.el9_7.2
Oracle Linux · 9 opencryptoki-swtok 0:3.25.0-4.el9_7.2

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-23893

    openCryptoki has improper link resolution before file access (link following)

    openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by plan…

    opencryptoki opencryptoki opencryptoki opencryptoki Debian Ubuntu Azure Linux