SUSE alert openSUSE-SU-2026:20699-1 (opencryptoki)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:20699-1: moderate: Security update for openCryptoki
Date:
             
 
Fri, 08 May 2026 13:20:44 +0200
Message-ID:
             
 
<20260508112044.E39EFFEC9@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for opencryptoki
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:20699-1
Rating: moderate
References:

  * bsc#1262283
  * bsc#1263819



Cross-References:

  * CVE-2026-40253



Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves one vulnerability and has 2 bug fixes can now be installed.

Description:

This update for openCryptoki fixes the following issues

Security issue:

- CVE-2026-40253: Updated fix for malformed BER-encoded cryptographic objects
  (bsc#1262283).

Non security issue:

- Refactored .spec file to fully support transactional and immutable operating systems
 (jsc#PED-14609):
 * Migrated user and group creation (pkcs11, pkcsslotd) from imperative %pre shell commands to
 declarative systemd-sysusers configuration.
 * Replaced manual /var directory tracking and %ghost directives with
 comprehensive systemd-tmpfiles configurations.
 * Implemented dynamic, architecture-specific tmpfiles.d generation to properly provision
 hardware-specific token directories (e.g., ccatok, ep11tok, lite, and HSM_MK_CHANGE).
- Fixed permissions for /run/opencryptoki within tmpfiles.d to ensure the
 daemon can successfully drop privileges and bind its communication socket.
 * Moved 32-bit and 64-bit shared library symlink creation (such as PKCS11_API.so, stdll, and
methods)
 from %post scriptlets into the %install phase,
 ensuring they are correctly packaged and tracked on the read-only /usr partition.
 * Removed legacy /etc/pkcs11 bash migration logic from %post,
 replacing it with a declarative tmpfiles.d symlink rule.
- Cleaned up scriptlets to only execute transaction-safe macros
 (such as ldconfig and systemd service handlers).


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-718=1

Package List:

- openSUSE Leap 16.0:

  openCryptoki-3.26.0-160000.2.1
  openCryptoki-64bit-3.26.0-160000.2.1
  openCryptoki-devel-3.26.0-160000.2.1

References:

  * https://www.suse.com/security/cve/CVE-2026-40253.html