<div class="container">
<h1>Security update for openCryptoki</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:20434-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-02-13T17:42:04Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1256673">bsc#1256673</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257116">bsc#1257116</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-14609">jsc#PED-14609</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-14798">jsc#PED-14798</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-22791.html">CVE-2026-22791</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-23893.html">CVE-2026-23893</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-22791</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-22791</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-22791</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.6</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-22791</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-23893</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.8</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-23893</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.8</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves two vulnerabilities and contains two features can now be installed.</p>
<h2>Description:</h2>
<p>This update for openCryptoki fixes the following issues:</p>
<p>Upgrade openCryptoki to 3.26 (jsc#PED-14609)</p>
<p>Security fixes:</p>
<ul>
<li>CVE-2026-22791: supplying malformed compressed EC public key can lead to heap corruption or denial-of-service (bsc#1256673).</li>
<li>CVE-2026-23893: Privilege Escalation or Data Exposure via Symlink Following (bsc#1257116).</li>
</ul>
<p>Other fixes:</p>
<ul>
<li>Soft: Add support for RSA keys up to 16K bits.</li>
<li>CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or later).</li>
<li>p11sak: Add support for generating RSA keys up to 16K bits.</li>
<li>Soft/ICA: Add support for SHA512/224 and SHA512/256 key derivation mechanism (CKM_SHA512_224_KEY_DERIVATION and CKM_SHA512_256_KEY_DERIVATION).</li>
<li>Soft/ICA/CCA/EP11: Add support for SHA-HMAC key types CKK_SHAxxx_HMAC and key gen mechanisms CKM_SHAxxx_KEY_GEN.</li>
<li>p11sak: Add support for SHA-HMAC key types and key generation.</li>
<li>p11sak: Add support for key wrap and unwrap commands to export and import private and secret keys by means of key wrapping/unwrapping
with various key wrapping mechanism.</li>
<li>p11kmip: Add support for using an HSM-protected TLS client key via a PKCS#11 provider.</li>
<li>p11sak: Add support for exporting non-sensitive private keys to password protected PEM files.</li>
<li>Add support for canceling an operation via NULL mechanism pointer at C_XxxInit() call as an alternative to C_SessionCancel() (PKCS#11 v3.0).</li>
<li>EP11: Add support for pairing friendly BLS12-381 EC curve for sign/verify using CKM_IBM_ECDSA_OTHER and signature/public key aggregation using CKM_IBM_EC_AGGREGATE.</li>
<li>p11sak: Add support for generating BLS12-381 EC keys.</li>
<li>EP11: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later, and
a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).</li>
<li>CCA: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires CCA v8.4 or later).</li>
<li>Soft: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or the OQS-provider must be configured).</li>
<li>p11sak: Add support for IBM-specific ML-DSA and ML-KEM key types.</li>
<li>Bug fixes.</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-284=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP Applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-284=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
<ul>
<li>openCryptoki-debuginfo-3.26.0-160000.1.1</li>
<li>openCryptoki-debugsource-3.26.0-160000.1.1</li>
<li>openCryptoki-64bit-debuginfo-3.26.0-160000.1.1</li>
<li>openCryptoki-devel-3.26.0-160000.1.1</li>
<li>openCryptoki-64bit-3.26.0-160000.1.1</li>
<li>openCryptoki-3.26.0-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP Applications 16.0 (ppc64le x86_64)
<ul>
<li>openCryptoki-debuginfo-3.26.0-160000.1.1</li>
<li>openCryptoki-debugsource-3.26.0-160000.1.1</li>
<li>openCryptoki-64bit-debuginfo-3.26.0-160000.1.1</li>
<li>openCryptoki-devel-3.26.0-160000.1.1</li>
<li>openCryptoki-64bit-3.26.0-160000.1.1</li>
<li>openCryptoki-3.26.0-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-22791.html">https://www.suse.com/security/cve/CVE-2026-22791.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-23893.html">https://www.suse.com/security/cve/CVE-2026-23893.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1256673">https://bugzilla.suse.com/show_bug.cgi?id=1256673</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257116">https://bugzilla.suse.com/show_bug.cgi?id=1257116</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-14609">https://jira.suse.com/browse/PED-14609</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-14798">https://jira.suse.com/browse/PED-14798</a>
</li>
</ul>
</div>