Red Hat Product Errata RHSA-2026:5587 - Security Advisory
Issued:
2026-03-24
Updated:
2026-03-24

RHSA-2026:5587 - Security Advisory

Synopsis

Moderate: opencryptoki security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for opencryptoki is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities.

Security Fix(es):

  • openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following (CVE-2026-23893)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

  • BZ - 2431909 - CVE-2026-23893 openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following

Red Hat Enterprise Linux for x86_64 8

SRPM
opencryptoki-3.22.0-3.el8_10.2.src.rpm SHA-256: 727821bb0a24ab68ea8896676131dbb3f02c047f4cb2810b7fd24d26d3165d4f
x86_64
opencryptoki-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 46b9d269d72b8d9e4281b828f5af4dd44c66f1a3220eb5c70fa7c8aa601ab8eb
opencryptoki-debuginfo-3.22.0-3.el8_10.2.i686.rpm SHA-256: de3a15d8e82fff0e440ca232ba80fccc752ebeb6b334ce663c0465124dbe8899
opencryptoki-debuginfo-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: d3d770bb0d1fc8417965f174dafe3276e983e55ce82db3bbf3a4699d7191035a
opencryptoki-debugsource-3.22.0-3.el8_10.2.i686.rpm SHA-256: f78ae8812419fc5a10bd2419e1eb0012cbabe7336ac3e7ee657d47fc9e567291
opencryptoki-debugsource-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 72937070203f77476b4287bfd78c602af035230a76b03fb5de7be54af387423e
opencryptoki-icsftok-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 4958ad1a63e78ddfc4aba53717f2ec2bb0696ec1fc884f2f15f1af1a6d200506
opencryptoki-icsftok-debuginfo-3.22.0-3.el8_10.2.i686.rpm SHA-256: cd7e81e607a9ad22f4b3c5042755150f814339f61f39a53363708e4f1b0d69fb
opencryptoki-icsftok-debuginfo-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 9f662b2a3a1e4f3ecfd323e9bc7aebd4ddeca21f6d8f42f406b16112fc6e3454
opencryptoki-libs-3.22.0-3.el8_10.2.i686.rpm SHA-256: 4aa6d119a0e84a96123ab20f587a785ee18a6269bdffd464f7b08bfdd2ebbcf5
opencryptoki-libs-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 5d4afd54a41c6ec0ef3ebbbb3f4c12f24042c218717beef41ccb19a8f9eccfd0
opencryptoki-libs-debuginfo-3.22.0-3.el8_10.2.i686.rpm SHA-256: c2cdf86a7ddf30fa709872dc008ee687df04624a0c1c41a42152f42bf35f184c
opencryptoki-libs-debuginfo-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 377af83da9afc579291282b9519938a0d6fc02e0fd3dc586a7d01adb99ddbb23
opencryptoki-swtok-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 4b3735363c03b36a7ce16a680b09d88c2bffa3a5bd3b17d83c4d0cfa6389ba63
opencryptoki-swtok-debuginfo-3.22.0-3.el8_10.2.i686.rpm SHA-256: a0f00f386bf9a0d6f5a639a9918e2052b795ad9b44a08bcda96ad812db21fa5c
opencryptoki-swtok-debuginfo-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 720da75f46e7eaefc35e05a7e1ee487e0602c2e78f20908b0a7c5af35070b0aa
opencryptoki-tpmtok-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 3965dc4f000e51383ee8e1f7b6fa2befae2c8316da2480b906abee85738fea6c
opencryptoki-tpmtok-debuginfo-3.22.0-3.el8_10.2.i686.rpm SHA-256: c144485afe337854a927130ee46c0ff86e6d8ea33b69b48e77fe77bf9bb5b9f6
opencryptoki-tpmtok-debuginfo-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 309a7d4ae573d6f8dc9dc8dae18b650f11ddadc2a7ffb2790264d19860b8a2c6

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
opencryptoki-3.22.0-3.el8_10.2.src.rpm SHA-256: 727821bb0a24ab68ea8896676131dbb3f02c047f4cb2810b7fd24d26d3165d4f
s390x
opencryptoki-3.22.0-3.el8_10.2.s390x.rpm SHA-256: b5af650381793763aeb965ffb715eec9da427e73a9a6e06744a242c042c4c8d4
opencryptoki-ccatok-3.22.0-3.el8_10.2.s390x.rpm SHA-256: a760b5ced2e67df8d587cdcc5756eb0e8007a7c9511fc50506b548c5bd7571ad
opencryptoki-ccatok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: a7d604ae5ba64f4b66d8620ca3cdf7c1588f2a3f62bb00720d34dd6aa80931f1
opencryptoki-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 38d561a7c3aac02d368a34739b038a0eccefc5a517f3654749c5b94eaca5b425
opencryptoki-debugsource-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 111a1eb53ee3159d313dfe413c58e20c461ab603c236d985eee5fba2cb9ff27b
opencryptoki-ep11tok-3.22.0-3.el8_10.2.s390x.rpm SHA-256: fc704a98dc521b8a93bb0a7c9de6538321792080427795ee8d3a187df5fbb9bf
opencryptoki-ep11tok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: c10fca2c77f7e5ab8df58f371fa43814886195d283ca03e6a51c7d000d596974
opencryptoki-icatok-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 24cc5133c33d7b4d2c60d6481c2647458be0881e09e7e471f442bea186c7b022
opencryptoki-icatok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 039b4f44dc9aae40a0d4f8944a97cfd7f6476ca77e206b7be6e5a5b74095fe9f
opencryptoki-icsftok-3.22.0-3.el8_10.2.s390x.rpm SHA-256: b34d30e8f5b456ef1a183b533fc26b46e20e18ca7941dbb0e630d82a37886e86
opencryptoki-icsftok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: ed1447d42157631858563ee4b5f71d08c2c7d138992062d190e55aa61fbcb3a4
opencryptoki-libs-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 9a0601fb5ed05b8b60161644591deb20b29550c3b1eee5bade5f326aa6c62fd3
opencryptoki-libs-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 065baf37ea509ffe4e49a395cf5e4d58d371228a4273edc255324de1452eb5ca
opencryptoki-swtok-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 8c8ddea9da4c0665fd6b164d69aa2eadfebbe4878e0c98ab87e5e3053105467f
opencryptoki-swtok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 4a3bc113af86da5d8d5cd7d9d782c73ad1557dfbc3cc9e89cdf31f50abf10114
opencryptoki-tpmtok-3.22.0-3.el8_10.2.s390x.rpm SHA-256: cd93efb04de7e9fba81d419b857a0b868178af3f3c42600135c71d77cd402ed3
opencryptoki-tpmtok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 8493ddda135f4d265af5797315c516b6fd840d1311d038278791d9c64b637c5a

Red Hat Enterprise Linux for Power, little endian 8

SRPM
opencryptoki-3.22.0-3.el8_10.2.src.rpm SHA-256: 727821bb0a24ab68ea8896676131dbb3f02c047f4cb2810b7fd24d26d3165d4f
ppc64le
opencryptoki-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: c40df0c70b8d7e55505dbd2cfa7f046bcac98d46826dfaa28b2818bba5c82567
opencryptoki-debuginfo-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: d823d7a942786d90e60e85b2d00c1d9668293ceb69de83096aea7ee6eb06834c
opencryptoki-debugsource-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: 4c0f455f6476e6a34e676bb08f8a3feed8b2001be874748f52bdfcbef6f09520
opencryptoki-icsftok-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: f5349a775613bc0fc50c380ff43dcf6566b51c9c2f121c1c7ff90f5764173e05
opencryptoki-icsftok-debuginfo-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: b2c45489df9bb235977a77e2856949d42f4cc9bf5528054f12644fd50abcac6d
opencryptoki-libs-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: a8ddfb0c078a74c4251873249a061e1adfab5cbf628e9b77288dec8591b09d11
opencryptoki-libs-debuginfo-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: 5ccad734a2cf419622f6d6998f1692b519c7592e3f3d706511fbbd5322c4e8d1
opencryptoki-swtok-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: 368c94cf1bda976c3b8ac59cb292bf04328cedb2dd8ee7242fa2c5f4017cf6ca
opencryptoki-swtok-debuginfo-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: a9ed75df4a20cae8c24ab8d379d4a3a38f3ac882861ab8859b93d57bb2a29f95
opencryptoki-tpmtok-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: 90a692ad8fee62868b79fe6acc6da5d4bb1deb1752b7bddaebb57bca7d6fb538
opencryptoki-tpmtok-debuginfo-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: 2ed5fade321dc2a48464fec859a9eb63974ec3ae78e51dfb2aad95525836f14e

Red Hat Enterprise Linux for ARM 64 8

SRPM
opencryptoki-3.22.0-3.el8_10.2.src.rpm SHA-256: 727821bb0a24ab68ea8896676131dbb3f02c047f4cb2810b7fd24d26d3165d4f
aarch64
opencryptoki-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: 2a71e5fe44df93d7afe7bf12c12e18b360096717910b52cb8c79a36d275cc62b
opencryptoki-debuginfo-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: cf2b2bb0df202450b97fa1b308ef62f6a7291f470c36a96fd2ff790478b9e9e3
opencryptoki-debugsource-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: 5092460bda0ab419d91d700b63172c36f9491effe775118ec93f6c91041758b5
opencryptoki-icsftok-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: b403df5476218196ca37ada770ecb4bd29860cc8c24ddfce0c7feb745d38e7f4
opencryptoki-icsftok-debuginfo-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: bd678539979bf498d9ad67a0be44fd80bb83a7d9b57432e6d980706c5d052e57
opencryptoki-libs-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: d3e7ac23e10cba494f9593e869fd3e1831076d1ad42665966f80eeb0cf913da8
opencryptoki-libs-debuginfo-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: d38204c9e1abd815bc2771da89193e577a04be099e325e864333d94f1a292370
opencryptoki-swtok-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: 01711bad782519687cd80595b16e73088200c84d765ee0a49dfffc08afdf2fe8
opencryptoki-swtok-debuginfo-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: f612d0ca6bcfde08bffe44f1997307a65e232a022dd1cc850f5a3962678ed16d
opencryptoki-tpmtok-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: 06d65b0851d429a448fa1dd1b54e937774a3b5167414a7f888d089b0eda7ded3
opencryptoki-tpmtok-debuginfo-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: 79713fadebf6e1d3de245fab2ce479fb59c5d436403a59b768509d94d08772c4

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
opencryptoki-debuginfo-3.22.0-3.el8_10.2.i686.rpm SHA-256: de3a15d8e82fff0e440ca232ba80fccc752ebeb6b334ce663c0465124dbe8899
opencryptoki-debuginfo-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: d3d770bb0d1fc8417965f174dafe3276e983e55ce82db3bbf3a4699d7191035a
opencryptoki-debugsource-3.22.0-3.el8_10.2.i686.rpm SHA-256: f78ae8812419fc5a10bd2419e1eb0012cbabe7336ac3e7ee657d47fc9e567291
opencryptoki-debugsource-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 72937070203f77476b4287bfd78c602af035230a76b03fb5de7be54af387423e
opencryptoki-devel-3.22.0-3.el8_10.2.i686.rpm SHA-256: a28bac60b4dc7cbaa40c5ffd7b154267c4db8354b5c823e12bf60d895a9b7502
opencryptoki-devel-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 8298c936804aa3f7080f7f360641a76dc3e42f665b4dd0d0ab28e8df55abf6bf
opencryptoki-icsftok-debuginfo-3.22.0-3.el8_10.2.i686.rpm SHA-256: cd7e81e607a9ad22f4b3c5042755150f814339f61f39a53363708e4f1b0d69fb
opencryptoki-icsftok-debuginfo-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 9f662b2a3a1e4f3ecfd323e9bc7aebd4ddeca21f6d8f42f406b16112fc6e3454
opencryptoki-libs-debuginfo-3.22.0-3.el8_10.2.i686.rpm SHA-256: c2cdf86a7ddf30fa709872dc008ee687df04624a0c1c41a42152f42bf35f184c
opencryptoki-libs-debuginfo-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 377af83da9afc579291282b9519938a0d6fc02e0fd3dc586a7d01adb99ddbb23
opencryptoki-swtok-debuginfo-3.22.0-3.el8_10.2.i686.rpm SHA-256: a0f00f386bf9a0d6f5a639a9918e2052b795ad9b44a08bcda96ad812db21fa5c
opencryptoki-swtok-debuginfo-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 720da75f46e7eaefc35e05a7e1ee487e0602c2e78f20908b0a7c5af35070b0aa
opencryptoki-tpmtok-debuginfo-3.22.0-3.el8_10.2.i686.rpm SHA-256: c144485afe337854a927130ee46c0ff86e6d8ea33b69b48e77fe77bf9bb5b9f6
opencryptoki-tpmtok-debuginfo-3.22.0-3.el8_10.2.x86_64.rpm SHA-256: 309a7d4ae573d6f8dc9dc8dae18b650f11ddadc2a7ffb2790264d19860b8a2c6

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
opencryptoki-debuginfo-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: d823d7a942786d90e60e85b2d00c1d9668293ceb69de83096aea7ee6eb06834c
opencryptoki-debugsource-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: 4c0f455f6476e6a34e676bb08f8a3feed8b2001be874748f52bdfcbef6f09520
opencryptoki-devel-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: d8573f6b028812cdc03944c9fe3a7f241eeeee5384ae77da3a21543933b1899d
opencryptoki-icsftok-debuginfo-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: b2c45489df9bb235977a77e2856949d42f4cc9bf5528054f12644fd50abcac6d
opencryptoki-libs-debuginfo-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: 5ccad734a2cf419622f6d6998f1692b519c7592e3f3d706511fbbd5322c4e8d1
opencryptoki-swtok-debuginfo-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: a9ed75df4a20cae8c24ab8d379d4a3a38f3ac882861ab8859b93d57bb2a29f95
opencryptoki-tpmtok-debuginfo-3.22.0-3.el8_10.2.ppc64le.rpm SHA-256: 2ed5fade321dc2a48464fec859a9eb63974ec3ae78e51dfb2aad95525836f14e

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
opencryptoki-debuginfo-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: cf2b2bb0df202450b97fa1b308ef62f6a7291f470c36a96fd2ff790478b9e9e3
opencryptoki-debugsource-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: 5092460bda0ab419d91d700b63172c36f9491effe775118ec93f6c91041758b5
opencryptoki-devel-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: 1eb330cc7b06c183e0aa6c858d463661680eb3194a40bce625d3f8b955d63895
opencryptoki-icsftok-debuginfo-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: bd678539979bf498d9ad67a0be44fd80bb83a7d9b57432e6d980706c5d052e57
opencryptoki-libs-debuginfo-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: d38204c9e1abd815bc2771da89193e577a04be099e325e864333d94f1a292370
opencryptoki-swtok-debuginfo-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: f612d0ca6bcfde08bffe44f1997307a65e232a022dd1cc850f5a3962678ed16d
opencryptoki-tpmtok-debuginfo-3.22.0-3.el8_10.2.aarch64.rpm SHA-256: 79713fadebf6e1d3de245fab2ce479fb59c5d436403a59b768509d94d08772c4

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
opencryptoki-ccatok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: a7d604ae5ba64f4b66d8620ca3cdf7c1588f2a3f62bb00720d34dd6aa80931f1
opencryptoki-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 38d561a7c3aac02d368a34739b038a0eccefc5a517f3654749c5b94eaca5b425
opencryptoki-debugsource-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 111a1eb53ee3159d313dfe413c58e20c461ab603c236d985eee5fba2cb9ff27b
opencryptoki-devel-3.22.0-3.el8_10.2.s390x.rpm SHA-256: a03f16639697b4243e5bfaa8608a6bafef08109d9dd6cc6e6004e0a6e15f18a8
opencryptoki-ep11tok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: c10fca2c77f7e5ab8df58f371fa43814886195d283ca03e6a51c7d000d596974
opencryptoki-icatok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 039b4f44dc9aae40a0d4f8944a97cfd7f6476ca77e206b7be6e5a5b74095fe9f
opencryptoki-icsftok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: ed1447d42157631858563ee4b5f71d08c2c7d138992062d190e55aa61fbcb3a4
opencryptoki-libs-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 065baf37ea509ffe4e49a395cf5e4d58d371228a4273edc255324de1452eb5ca
opencryptoki-swtok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 4a3bc113af86da5d8d5cd7d9d782c73ad1557dfbc3cc9e89cdf31f50abf10114
opencryptoki-tpmtok-debuginfo-3.22.0-3.el8_10.2.s390x.rpm SHA-256: 8493ddda135f4d265af5797315c516b6fd840d1311d038278791d9c64b637c5a

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.