红帽产品勘误 RHSA-2026:5603 - Security Advisory
发布：
2026-03-24
已更新：
2026-03-24

RHSA-2026:5603 - Security Advisory

概述

Moderate: opencryptoki security update

类型/严重性

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

识别并修复受此公告影响的系统。

查看受影响的系统

标题

An update for opencryptoki is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities.

Security Fix(es):

  • openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following (CVE-2026-23893)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

解决方案

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

受影响的产品

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 9 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x

修复

  • BZ - 2431909 - CVE-2026-23893 openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following

Red Hat Enterprise Linux for x86_64 9

SRPM
opencryptoki-3.25.0-4.el9_7.2.src.rpm SHA-256: 0c85d8b7a96ee2a504629bd75054cf317dab084a9df7c4669d849789abc93deb
x86_64
opencryptoki-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: e54f8d6f56d5ea79793c409776505b489565fcbd25f0f2ffc98bdf0247204a80
opencryptoki-ccatok-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: 851592efba731c3dab256cee13865871da0b57ab7df5a5da66a4970667105f58
opencryptoki-ccatok-debuginfo-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: 3207a9e0a98c1301349623edf33ecdc1306f878685451305ac6bc61dd1b70c2a
opencryptoki-debuginfo-3.25.0-4.el9_7.2.i686.rpm SHA-256: c142030175393594a8971eb895449e3f5ddd944684af569f0e3500a137404535
opencryptoki-debuginfo-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: 61d5c7d35c5d056b788609e9ce17c651d9dadf1d369e45f404481db717d97e4e
opencryptoki-debugsource-3.25.0-4.el9_7.2.i686.rpm SHA-256: b24246aa1a477d608844e13c60408f6c0f2f52115f4d54ca6994bc1bd052325f
opencryptoki-debugsource-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: d00a8b1d966ac957eaeb6033d8d4200d33653a64b485c324ab416ef5a3192fd6
opencryptoki-icsftok-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: e84bd3657c64b2437de2d662694e72e77a9def2315329335840308774363a402
opencryptoki-icsftok-debuginfo-3.25.0-4.el9_7.2.i686.rpm SHA-256: 7253f5dff5e84cf7a1d0806a0ca48635489ce92bf3c8b18100a6a624c7e74c8b
opencryptoki-icsftok-debuginfo-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: c0d991ce59c2660671d87e5cff91065ab1ba34229abb64791760bf880a05cfbf
opencryptoki-libs-3.25.0-4.el9_7.2.i686.rpm SHA-256: 2ef38d0e4dabb7984ac6dd3199580a502b28394c2b69a1240cca00071c56d96d
opencryptoki-libs-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: 29b103cb0198f22d7aeae3adf6d43781da13f0768c1d4bc123cd0e3da056497b
opencryptoki-libs-debuginfo-3.25.0-4.el9_7.2.i686.rpm SHA-256: bbb1c74d4255c252b5b4f1dbde880a8ec6a5dd36414815e135a23493da936a0c
opencryptoki-libs-debuginfo-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: 03455eadcf8722ea192c90801ef8941de28e3917082f81f2d0a2c5a2fa396928
opencryptoki-swtok-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: 88df4d3ed323d9585fbe1ee52cf87b5bd4b4eeb6c3851c401e0ff619019943c6
opencryptoki-swtok-debuginfo-3.25.0-4.el9_7.2.i686.rpm SHA-256: 1c927b60bda029212f14ab322f8bd87321b01c7eb13c2ff8d996279e19452e24
opencryptoki-swtok-debuginfo-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: b0971e36a826c2fc4d0914be91a749704b452ca93eca936dea8ce2851628b8dd

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
opencryptoki-3.25.0-4.el9_7.2.src.rpm SHA-256: 0c85d8b7a96ee2a504629bd75054cf317dab084a9df7c4669d849789abc93deb
s390x
opencryptoki-3.25.0-4.el9_7.2.s390x.rpm SHA-256: eca3872e9687e62b047d1bf23704de303e888119e14578c4693900de38d168d5
opencryptoki-ccatok-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 84d3c2300673f6883be4cb0cb77c14eefd97411b4a6ece1b4f2c765a788bc8ee
opencryptoki-ccatok-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: bb93a8ab6bf23a3137c4dc1004f12381e2dcb2600799a2575612ab2b751125d6
opencryptoki-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: f12a56e729f6c573ffff426c9707601c659d4dae8e915bba38f9a3078ae0650b
opencryptoki-debugsource-3.25.0-4.el9_7.2.s390x.rpm SHA-256: f6f9d92d52ef436535cf68825d0bb554758ab4f1c42ac106bc32278f60497087
opencryptoki-ep11tok-3.25.0-4.el9_7.2.s390x.rpm SHA-256: fd31462ec436031f9db3a7d07181892fe50e0fe83f4dcc7827b6d276522f9fbe
opencryptoki-ep11tok-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 3644f3e1c2c30f1f29118c60abe890e633fd9c448495a6b3f243c9216924a656
opencryptoki-icatok-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 15d065a4003da84d38b1d7b94494d8d84cdede75810cceee947acf5bd4d1738f
opencryptoki-icatok-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 1949e8a97f0f8615d40c7bb5db12cc39d3da80a9a0d84399f9c8d75257606e01
opencryptoki-icsftok-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 696a9cd3cab8eac821ecbe72e949422746fbd193e61474004e35790cc5d693a5
opencryptoki-icsftok-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 52c73f55c360b068409e9ff406aed025045e00b8ffd8a7b15880dcf346cf79cf
opencryptoki-libs-3.25.0-4.el9_7.2.s390x.rpm SHA-256: e7e85993826fddab327c0422bd016697fe9f559f958819d1db25d386bb854458
opencryptoki-libs-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 1d12a79d6d4b7be5845856b81a15172af029e2c4e68c84595db5044b4f2c6912
opencryptoki-swtok-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 7d26250cd551956934bb48cfa41fd56c49433801ff03906425fa7ba38fd039a4
opencryptoki-swtok-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: f0a7b8e3b121a10e4f728b7c3b501a3778d467273cc42e51f9b2f895ba1618b0

Red Hat Enterprise Linux for Power, little endian 9

SRPM
opencryptoki-3.25.0-4.el9_7.2.src.rpm SHA-256: 0c85d8b7a96ee2a504629bd75054cf317dab084a9df7c4669d849789abc93deb
ppc64le
opencryptoki-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: 2cb282c1e9e301784a8c2e4cda5a5c37bda25be0e8f9890ab14f522b309312ca
opencryptoki-ccatok-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: 8be3cdd06b4ee18b026c410c87795e3a610663fcf081c739c9c0216601cfba3a
opencryptoki-ccatok-debuginfo-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: 5c8b1325facd5f916a75744c51ce1cf77816a4caea18173e3166e37ed1fbe7f4
opencryptoki-debuginfo-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: 356faebd674fbd38383fa813b412826d7e614a95c530f7d91695dd208411c677
opencryptoki-debugsource-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: f93543b5b2d5bd0fc9483f5fbfde862f11b35e2056f9b4fb3fd38fc05b2f29f0
opencryptoki-icsftok-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: 02df8724d05d4a883c5d11096ee31bc3f633fe635b73edc0c62f1982a1f3e99b
opencryptoki-icsftok-debuginfo-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: 74b01af85782b7bc41de703d2aad01ae7915e94e9cef4dda08c56a201591ea08
opencryptoki-libs-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: a5a059fc5d6ddca7021b20375d2bca5fb82d3daf905a5a0c8e8635ccef4c3791
opencryptoki-libs-debuginfo-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: bdd6af973236ef87e38bfa43629c54607cddb924df0e519dbd98c695b2d9c9fc
opencryptoki-swtok-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: c584452307b1151fb0a5580ef969a81633dbbdaeecb72c5ba54f01b954a6db78
opencryptoki-swtok-debuginfo-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: b513d2072d8e0ccbda627802e7116e43f4776d846ce7c7aa1c0c06f09ba696c8

Red Hat Enterprise Linux for ARM 64 9

SRPM
opencryptoki-3.25.0-4.el9_7.2.src.rpm SHA-256: 0c85d8b7a96ee2a504629bd75054cf317dab084a9df7c4669d849789abc93deb
aarch64
opencryptoki-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 52047fb9325655492181e875e37194f1b94212da15c3101f9be554c33177862f
opencryptoki-debuginfo-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 91cabd7cabce137157cdbd094d2e7606781734efaa1e305dacdd5f5336c7ce44
opencryptoki-debugsource-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 50c88b3d74524473ced0bd004e1b92cca3c540739eed6565de6c74ed27004156
opencryptoki-icsftok-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 50b0978d63929c68378177b4c7fdbda19e0c667fd9642a8ea2de2779ec604138
opencryptoki-icsftok-debuginfo-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 0c8f7a52bdeffe8ab9f949e800e505b079e4bff35726d059e305e1465de6f2e0
opencryptoki-libs-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 2488865f40b69a0051aac945237bd24f950b1c47b8455f84de3a78e81b3df681
opencryptoki-libs-debuginfo-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 2dc832170bf1145f0f705ab42e7729069566f849243840db90a1826c41ed8350
opencryptoki-swtok-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 49b299130dcd38a8dddd52ead66fb67231a5d73ba9c63cd43ad48e6a10903dc8
opencryptoki-swtok-debuginfo-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 304de57e82e9f66279da19183986bc68e162a4e1e3224f159dad4d36e83a8d05

Red Hat CodeReady Linux Builder for x86_64 9

SRPM
x86_64
opencryptoki-ccatok-debuginfo-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: 3207a9e0a98c1301349623edf33ecdc1306f878685451305ac6bc61dd1b70c2a
opencryptoki-debuginfo-3.25.0-4.el9_7.2.i686.rpm SHA-256: c142030175393594a8971eb895449e3f5ddd944684af569f0e3500a137404535
opencryptoki-debuginfo-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: 61d5c7d35c5d056b788609e9ce17c651d9dadf1d369e45f404481db717d97e4e
opencryptoki-debugsource-3.25.0-4.el9_7.2.i686.rpm SHA-256: b24246aa1a477d608844e13c60408f6c0f2f52115f4d54ca6994bc1bd052325f
opencryptoki-debugsource-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: d00a8b1d966ac957eaeb6033d8d4200d33653a64b485c324ab416ef5a3192fd6
opencryptoki-devel-3.25.0-4.el9_7.2.i686.rpm SHA-256: 7db8aed47009b9217954182f57906c46a658e5677f22b0e3ead3adbc8c2557d0
opencryptoki-devel-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: bdb66babd4f0618e8a4d79220b346a9338158c3ac835cbd5242ddc41a90b5bb4
opencryptoki-icsftok-debuginfo-3.25.0-4.el9_7.2.i686.rpm SHA-256: 7253f5dff5e84cf7a1d0806a0ca48635489ce92bf3c8b18100a6a624c7e74c8b
opencryptoki-icsftok-debuginfo-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: c0d991ce59c2660671d87e5cff91065ab1ba34229abb64791760bf880a05cfbf
opencryptoki-libs-debuginfo-3.25.0-4.el9_7.2.i686.rpm SHA-256: bbb1c74d4255c252b5b4f1dbde880a8ec6a5dd36414815e135a23493da936a0c
opencryptoki-libs-debuginfo-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: 03455eadcf8722ea192c90801ef8941de28e3917082f81f2d0a2c5a2fa396928
opencryptoki-swtok-debuginfo-3.25.0-4.el9_7.2.i686.rpm SHA-256: 1c927b60bda029212f14ab322f8bd87321b01c7eb13c2ff8d996279e19452e24
opencryptoki-swtok-debuginfo-3.25.0-4.el9_7.2.x86_64.rpm SHA-256: b0971e36a826c2fc4d0914be91a749704b452ca93eca936dea8ce2851628b8dd

Red Hat CodeReady Linux Builder for Power, little endian 9

SRPM
ppc64le
opencryptoki-ccatok-debuginfo-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: 5c8b1325facd5f916a75744c51ce1cf77816a4caea18173e3166e37ed1fbe7f4
opencryptoki-debuginfo-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: 356faebd674fbd38383fa813b412826d7e614a95c530f7d91695dd208411c677
opencryptoki-debugsource-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: f93543b5b2d5bd0fc9483f5fbfde862f11b35e2056f9b4fb3fd38fc05b2f29f0
opencryptoki-devel-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: daedcb6f96831bf073f3eb506d0e44aad1dd9a7d7940aac88b2bd3908e6b9509
opencryptoki-icsftok-debuginfo-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: 74b01af85782b7bc41de703d2aad01ae7915e94e9cef4dda08c56a201591ea08
opencryptoki-libs-debuginfo-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: bdd6af973236ef87e38bfa43629c54607cddb924df0e519dbd98c695b2d9c9fc
opencryptoki-swtok-debuginfo-3.25.0-4.el9_7.2.ppc64le.rpm SHA-256: b513d2072d8e0ccbda627802e7116e43f4776d846ce7c7aa1c0c06f09ba696c8

Red Hat CodeReady Linux Builder for ARM 64 9

SRPM
aarch64
opencryptoki-debuginfo-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 91cabd7cabce137157cdbd094d2e7606781734efaa1e305dacdd5f5336c7ce44
opencryptoki-debugsource-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 50c88b3d74524473ced0bd004e1b92cca3c540739eed6565de6c74ed27004156
opencryptoki-devel-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 159a29f9e0e30cdf8e475fd733061f271b340ea45b90ee4b858020b83762f5aa
opencryptoki-icsftok-debuginfo-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 0c8f7a52bdeffe8ab9f949e800e505b079e4bff35726d059e305e1465de6f2e0
opencryptoki-libs-debuginfo-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 2dc832170bf1145f0f705ab42e7729069566f849243840db90a1826c41ed8350
opencryptoki-swtok-debuginfo-3.25.0-4.el9_7.2.aarch64.rpm SHA-256: 304de57e82e9f66279da19183986bc68e162a4e1e3224f159dad4d36e83a8d05

Red Hat CodeReady Linux Builder for IBM z Systems 9

SRPM
s390x
opencryptoki-ccatok-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: bb93a8ab6bf23a3137c4dc1004f12381e2dcb2600799a2575612ab2b751125d6
opencryptoki-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: f12a56e729f6c573ffff426c9707601c659d4dae8e915bba38f9a3078ae0650b
opencryptoki-debugsource-3.25.0-4.el9_7.2.s390x.rpm SHA-256: f6f9d92d52ef436535cf68825d0bb554758ab4f1c42ac106bc32278f60497087
opencryptoki-devel-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 59e1922661b6426b58c5641d87d31d34c21b3db5d698cf70ccd3bdc31ad4519c
opencryptoki-ep11tok-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 3644f3e1c2c30f1f29118c60abe890e633fd9c448495a6b3f243c9216924a656
opencryptoki-icatok-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 1949e8a97f0f8615d40c7bb5db12cc39d3da80a9a0d84399f9c8d75257606e01
opencryptoki-icsftok-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 52c73f55c360b068409e9ff406aed025045e00b8ffd8a7b15880dcf346cf79cf
opencryptoki-libs-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: 1d12a79d6d4b7be5845856b81a15172af029e2c4e68c84595db5044b4f2c6912
opencryptoki-swtok-debuginfo-3.25.0-4.el9_7.2.s390x.rpm SHA-256: f0a7b8e3b121a10e4f728b7c3b501a3778d467273cc42e51f9b2f895ba1618b0

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。