SUSE-SU-2026:22293-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202622293-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22293-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:22293-1
- Upstream
- Related
- Published
- 2026-06-25T11:53:53Z
- Modified
- 2026-06-30T18:24:39Z
- Summary
- Security update for openCryptoki
- Details
-
This update for openCryptoki fixes the following issues
Upgrade openCryptoki to version 3.27 (jsc#PED-14609):
- Add base support for PKCS#11 v3.2.
- Add support for PKCS#11 v3.2 C_VerifySignature[Init|Update|Final].
- Add support for PKCS#11 v3.2 C_EncapsulateKey/C_DecapsulateKey.
- Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with RSA-PKCS and RSA-OAEP mechanisms.
- Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the ECDH mechanism.
- Soft/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the DH-PKCS mechanism.
- Soft: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or the OQS-provider must be configured).
- CCA: Add support for PKCS#11 v3.2 ML-DSA key type and mechanisms (requires CCA v8.4 or later)
- EP11: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later, and a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
- p11sak: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types.
- Soft/ICA: Add support for PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
- p11sak: Add support for key wrapping with PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
- Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 mechanism CKM_PUB_KEY_FROM_PRIV_KEY.
- Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.0 Edwards and Montgomery key types and mechanisms.
- Soft/ICA: Support CKM_ECDH_AES_KEY_WRAP also for Montgomery keys.
- p11sak: Add support for PKCS#11 v3.0 Edwards and Montgomery key types.
- Soft: Add support for CKM_ECDH1_COFACTOR_DERIVE.
- CCA: Add support for additional RSA public exponent values 5, 17, or 257.
- p11sak: Add option to list-key command to show EP11 session IDs.
- Make the maximum number of token objects supported configurable.
- Fixes for CVE-2026-40253, CVE-2026-23893, and CVE-2026-22791.
- Bug fixes.
- References