Description
A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | opencryptoki | Fixed in v3.17.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | opencryptoki | No fix yet | — |
| Ubuntu 26.04 LTS | opencryptoki | No fix yet | — |
| Ubuntu 25.10 | opencryptoki | No fix yet | — |
| Ubuntu 24.04 LTS | opencryptoki | No fix yet | — |
| Ubuntu 22.04 LTS | opencryptoki | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | opencryptoki | No fix yet | — |
| Ubuntu 18.04 LTS | opencryptoki | No fix yet | — |
| Ubuntu 16.04 LTS | opencryptoki | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | opencryptoki +8 | 3.15.1-6.el8_4 | RHBA-2021:3054 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | opencryptoki | 3.17.0-1 | — |
Advisories 1
- RHBA-2021:3054 Red Hat Bug Fix Advisory: opencryptoki bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026