{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"Medium" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"opencryptoki security update", "category":"general", "title":"Synopsis" }, { "text":"An update for opencryptoki is now available for openEuler-22.03-LTS-SP4", "category":"general", "title":"Summary" }, { "text":"openCryptoki is an implementation of the PKCS #11 API that allows interfacing to devices that hold cryptographic information and perform cryptographic functions. openCryptoki provides application portability by isolating the application from the details of the cryptographic device. Isolating the application also provides an added level of security. The openCryptoki API provides a standard programming interface between applications and all kinds of portable cryptographic devices.\n\nSecurity Fix(es):\n\nopenCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.(CVE-2026-40253)", "category":"general", "title":"Description" }, { "text":"An update for opencryptoki is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP2/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4.\n\nopenEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"Medium", "category":"general", "title":"Severity" }, { "text":"opencryptoki", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-2164", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2164" }, { "summary":"CVE-2026-40253", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-40253&packageName=opencryptoki" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40253" }, { "summary":"openEuler-SA-2026-2164 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-2164.json" } ], "title":"An update for opencryptoki is now available for openEuler-22.03-LTS-SP4", "tracking":{ "initial_release_date":"2026-05-03T18:08:19+08:00", "revision_history":[ { "date":"2026-05-03T18:08:19+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-05-03T18:08:19+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-05-03T18:08:19+08:00", "id":"openEuler-SA-2026-2164", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"openEuler-22.03-LTS-SP4", "name":"openEuler-22.03-LTS-SP4" }, "name":"openEuler-22.03-LTS-SP4", "category":"product_version" } ], "category":"product_name" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"opencryptoki-3.26.0-2.oe2203sp4.aarch64.rpm", "name":"opencryptoki-3.26.0-2.oe2203sp4.aarch64.rpm" }, "name":"opencryptoki-3.26.0-2.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"opencryptoki-debuginfo-3.26.0-2.oe2203sp4.aarch64.rpm", "name":"opencryptoki-debuginfo-3.26.0-2.oe2203sp4.aarch64.rpm" }, "name":"opencryptoki-debuginfo-3.26.0-2.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"opencryptoki-debugsource-3.26.0-2.oe2203sp4.aarch64.rpm", "name":"opencryptoki-debugsource-3.26.0-2.oe2203sp4.aarch64.rpm" }, "name":"opencryptoki-debugsource-3.26.0-2.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"opencryptoki-devel-3.26.0-2.oe2203sp4.aarch64.rpm", "name":"opencryptoki-devel-3.26.0-2.oe2203sp4.aarch64.rpm" }, "name":"opencryptoki-devel-3.26.0-2.oe2203sp4.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"opencryptoki-3.26.0-2.oe2203sp4.src.rpm", "name":"opencryptoki-3.26.0-2.oe2203sp4.src.rpm" }, "name":"opencryptoki-3.26.0-2.oe2203sp4.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"opencryptoki-3.26.0-2.oe2203sp4.x86_64.rpm", "name":"opencryptoki-3.26.0-2.oe2203sp4.x86_64.rpm" }, "name":"opencryptoki-3.26.0-2.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"opencryptoki-debuginfo-3.26.0-2.oe2203sp4.x86_64.rpm", "name":"opencryptoki-debuginfo-3.26.0-2.oe2203sp4.x86_64.rpm" }, "name":"opencryptoki-debuginfo-3.26.0-2.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"opencryptoki-debugsource-3.26.0-2.oe2203sp4.x86_64.rpm", "name":"opencryptoki-debugsource-3.26.0-2.oe2203sp4.x86_64.rpm" }, "name":"opencryptoki-debugsource-3.26.0-2.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"opencryptoki-devel-3.26.0-2.oe2203sp4.x86_64.rpm", "name":"opencryptoki-devel-3.26.0-2.oe2203sp4.x86_64.rpm" }, "name":"opencryptoki-devel-3.26.0-2.oe2203sp4.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"noarch", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"opencryptoki-help-3.26.0-2.oe2203sp4.noarch.rpm", "name":"opencryptoki-help-3.26.0-2.oe2203sp4.noarch.rpm" }, "name":"opencryptoki-help-3.26.0-2.oe2203sp4.noarch.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"opencryptoki-3.26.0-2.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:opencryptoki-3.26.0-2.oe2203sp4.aarch64", "name":"opencryptoki-3.26.0-2.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"opencryptoki-debuginfo-3.26.0-2.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:opencryptoki-debuginfo-3.26.0-2.oe2203sp4.aarch64", "name":"opencryptoki-debuginfo-3.26.0-2.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"opencryptoki-debugsource-3.26.0-2.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:opencryptoki-debugsource-3.26.0-2.oe2203sp4.aarch64", "name":"opencryptoki-debugsource-3.26.0-2.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"opencryptoki-devel-3.26.0-2.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:opencryptoki-devel-3.26.0-2.oe2203sp4.aarch64", "name":"opencryptoki-devel-3.26.0-2.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"opencryptoki-3.26.0-2.oe2203sp4.src.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:opencryptoki-3.26.0-2.oe2203sp4.src", "name":"opencryptoki-3.26.0-2.oe2203sp4.src as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"opencryptoki-3.26.0-2.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:opencryptoki-3.26.0-2.oe2203sp4.x86_64", "name":"opencryptoki-3.26.0-2.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"opencryptoki-debuginfo-3.26.0-2.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:opencryptoki-debuginfo-3.26.0-2.oe2203sp4.x86_64", "name":"opencryptoki-debuginfo-3.26.0-2.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"opencryptoki-debugsource-3.26.0-2.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:opencryptoki-debugsource-3.26.0-2.oe2203sp4.x86_64", "name":"opencryptoki-debugsource-3.26.0-2.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"opencryptoki-devel-3.26.0-2.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:opencryptoki-devel-3.26.0-2.oe2203sp4.x86_64", "name":"opencryptoki-devel-3.26.0-2.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"opencryptoki-help-3.26.0-2.oe2203sp4.noarch.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:opencryptoki-help-3.26.0-2.oe2203sp4.noarch", "name":"opencryptoki-help-3.26.0-2.oe2203sp4.noarch as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-40253", "notes":[ { "text":"openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:opencryptoki-3.26.0-2.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:opencryptoki-debuginfo-3.26.0-2.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:opencryptoki-debugsource-3.26.0-2.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:opencryptoki-devel-3.26.0-2.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:opencryptoki-3.26.0-2.oe2203sp4.src", "openEuler-22.03-LTS-SP4:opencryptoki-3.26.0-2.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:opencryptoki-debuginfo-3.26.0-2.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:opencryptoki-debugsource-3.26.0-2.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:opencryptoki-devel-3.26.0-2.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:opencryptoki-help-3.26.0-2.oe2203sp4.noarch" ] }, "remediations":[ { "product_ids":{"$ref":"$.vulnerabilities[0].product_status.fixed"}, "details":"opencryptoki security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2164" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.8, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version":"3.1" }, "products":{"$ref":"$.vulnerabilities[0].product_status.fixed"} } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-40253" } ] }