[ALSA-2026:92145] Critical: cjose security update
Type:
security
Severity:
critical
Release date:
2026-10-29
Description:
CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 cjose-0.6.1-17.el9_8.2.aarch64.rpm 734acc6a41789688fb1bc6c859e741341e89db93c21eff5ac2c5a7c594f7a681
aarch64 cjose-devel-0.6.1-17.el9_8.2.aarch64.rpm fcf11f4771fabeb8d246f70fdd00f752ad0c15b043facf63928c5798715c10de
i686 cjose-devel-0.6.1-17.el9_8.2.i686.rpm 153e465274166e5c58e8db4e6298fda306cee2d0f95ae772ae88d8793e899b7e
i686 cjose-0.6.1-17.el9_8.2.i686.rpm 33ba6dfdbfacb7a070a6d16183151433a0c97e9d46d512d250496120bc7916de
ppc64le cjose-0.6.1-17.el9_8.2.ppc64le.rpm 38073c7b1c4924021abb742bd9634dda8230dba57fdb69f96b9a09cf359991bc
ppc64le cjose-devel-0.6.1-17.el9_8.2.ppc64le.rpm 9f413c39673a0be15f6b69ffc0858c0054c0f8157de07c0e852d79c7888bbc57
s390x cjose-devel-0.6.1-17.el9_8.2.s390x.rpm 322c6a5d403782d472fbd88beaca4ad29492368d42377e1e9b4f8446f7bfe11f
s390x cjose-0.6.1-17.el9_8.2.s390x.rpm d050920abe429c2a3197c8ec03b67841ac54133e9436739f9ce6a01888d55c37
x86_64 cjose-0.6.1-17.el9_8.2.x86_64.rpm 2ff1438498cf126b24e83779974bc131a0ba765580e40ce559fef81c09068b97
x86_64 cjose-devel-0.6.1-17.el9_8.2.x86_64.rpm bf2541ea021510b66b4fb7c5217660354ff26e5b8957cb9e7fd2f7c337a422fc
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.