RHBA-2025:20566 - Bug Fix Advisory

Topic

An update for crypto-policies is now available for Red Hat Enterprise Linux 9.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

• RHEL-91839 - add a PQ subpolicy to RHEL-9 crypto-policies
• RHEL-103793 - X25519-MLKEM768 should be aliased to MLKEM768-X25519 [rhel-9]
• RHEL-104607 - enable ED25519 in RHEL-9 NSS policy
• RHEL-103786 - Update crypto policies to support PQC in rpm-sequoia [rhel-9]
• RHEL-103963 - enable ML-DSA in NSS in PQ subpolicy [rhel-9]
• RHEL-106866 - Enable ML-KEM hybrids in NSS in PQ subpolicy [rhel-9]
• RHEL-111491 - Red Hat packages cannot be installed with dnf multisig plugin
• RHEL-112697 - allow PQ algorithms in all rpm-sequoia crypto-policies (RHEL-9)

CVEs

(none)

References

• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.7_release_notes/index