[ALSA-2026:80605] Critical: cjose security update
Type:
security
Severity:
critical
Release date:
2026-10-12
Description:
CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 cjose-devel-0.6.2.2-7.el10_2.2.aarch64.rpm 42bcabfd2eda4dea98e09b7198b6c67bdeddb9f5680ff55b356915cb5b1fc28d
aarch64 cjose-0.6.2.2-7.el10_2.2.aarch64.rpm ca8d254eba46ca66faf9c76a17ba2ec8b5f9740758800d24ccf445e52171e9c8
ppc64le cjose-0.6.2.2-7.el10_2.2.ppc64le.rpm a1a95eb32c7ec9cea4ffdc745f9bbac5bd947ba34dfcbb42fcf95b913b1f27ca
ppc64le cjose-devel-0.6.2.2-7.el10_2.2.ppc64le.rpm e03942cc1386a4157e1571b716fd051c07c9f0dbc02a13b7ea9f14bdcfa887a3
s390x cjose-devel-0.6.2.2-7.el10_2.2.s390x.rpm 5c12f65fdc8799b9b44f59a8d326b7a49488a21409c572c96ecd65911966a165
s390x cjose-0.6.2.2-7.el10_2.2.s390x.rpm aed38dbfe56c465d8f1ae0435f0bbff3e6c8acfadeaef3f4ef5c77c88ceea829
x86_64 cjose-0.6.2.2-7.el10_2.2.x86_64.rpm 3bfdb14153a7cfda04f716b7c3d6ac468e910acb1024d7c137cf82277d47d796
x86_64 cjose-devel-0.6.2.2-7.el10_2.2.x86_64.rpm d105d5b1132edb7aa06f518eae269dbb1090426ed892bc2d748a2cc576c1d815
x86_64_v2 cjose-devel-0.6.2.2-7.el10_2.2.x86_64_v2.rpm cff5a23673ded22942d3c263bdc1553d23ed841b4b51a95f772e1195d04bea1f
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.