openSUSE-SU-2026:21059-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21059-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:21059-1

Upstream

CVE (3)

Related

CVE (3)

Published

2026-06-25T11:51:43Z

Modified

2026-06-30T18:24:44Z

Summary

Security update for openCryptoki

Details

This update for openCryptoki fixes the following issues

Upgrade openCryptoki to version 3.27 (jsc#PED-14609):

Add base support for PKCS#11 v3.2.
Add support for PKCS#11 v3.2 C_VerifySignature[Init|Update|Final].
Add support for PKCS#11 v3.2 C_EncapsulateKey/C_DecapsulateKey.
Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with RSA-PKCS and RSA-OAEP mechanisms.
Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the ECDH mechanism.
Soft/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the DH-PKCS mechanism.
Soft: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or the OQS-provider must be configured).
CCA: Add support for PKCS#11 v3.2 ML-DSA key type and mechanisms (requires CCA v8.4 or later)
EP11: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later, and a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
p11sak: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types.
Soft/ICA: Add support for PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
p11sak: Add support for key wrapping with PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 mechanism CKM_PUB_KEY_FROM_PRIV_KEY.
Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.0 Edwards and Montgomery key types and mechanisms.
Soft/ICA: Support CKM_ECDH_AES_KEY_WRAP also for Montgomery keys.
p11sak: Add support for PKCS#11 v3.0 Edwards and Montgomery key types.
Soft: Add support for CKM_ECDH1_COFACTOR_DERIVE.
CCA: Add support for additional RSA public exponent values 5, 17, or 257.
p11sak: Add option to list-key command to show EP11 session IDs.
Make the maximum number of token objects supported configurable.
Fixes for CVE-2026-40253, CVE-2026-23893, and CVE-2026-22791.
Bug fixes.

References

Affected packages

openSUSE:Leap 16.0 / openCryptoki

Package

Name: openCryptoki
Purl: pkg:rpm/opensuse/openCryptoki&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.27.0-160000.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "openCryptoki":  "3.27.0-160000.1.1",
            "openCryptoki-64bit":  "3.27.0-160000.1.1",
            "openCryptoki-devel":  "3.27.0-160000.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21059-1.json"