ELSA-2026-92157

ELSA-2026-92157 - mod_auth_openidc:2.3 security update

Type:SECURITY
Impact:CRITICAL
Release Date:2026-10-29

Description


cjose
[0.6.1-6]
- CVE-2026-53939 mod_auth_openidc:2.3/cjose: OpenIDC/cjose uses all-zero Content
Encryption Key for AES-CBC-HMAC JWE encryption
Resolves: RHEL-287898

mod_auth_openidc
[2.4.9.4-9]
- Resolves: RHEL-248080 CVE-2026-54789 Denial of Service via malformed state
cookie parsing


Related CVEs


CVE-2026-53939

Updated Packages


Release/ArchitectureFilenamesha256Superseded By AdvisoryChannel Label
Oracle Linux 8 (aarch64) cjose-0.6.1-6.module+el8.10.0+91088+2d069dc4.src.rpm08aff77c596ee0696347301bec7d3c64243f2bc1814fce84781a68c0f159db8c-ol8_aarch64_appstream
mod_auth_openidc-2.4.9.4-9.module+el8.10.0+91088+2d069dc4.src.rpmb515a7e12036d3ba8c33a8234df21ffa06f8d8e1cce047e7309dcd53277ede5d-ol8_aarch64_appstream
cjose-0.6.1-6.module+el8.10.0+91088+2d069dc4.aarch64.rpm4f7f9cd8a1ee4eb2d7ad283f19b708f28cfe0468662980f5990b1d26ba925d80-ol8_aarch64_appstream
cjose-devel-0.6.1-6.module+el8.10.0+91088+2d069dc4.aarch64.rpmfa696399e54ad54ec2c638e34697be074ca3da447bc4969b98ded8e305410b17-ol8_aarch64_appstream
mod_auth_openidc-2.4.9.4-9.module+el8.10.0+91088+2d069dc4.aarch64.rpm022f377dfa18f15651d18078c137417597d5b6cb6c08674fc3b23841744bff5c-ol8_aarch64_appstream
Oracle Linux 8 (x86_64) cjose-0.6.1-6.module+el8.10.0+91088+2d069dc4.src.rpm08aff77c596ee0696347301bec7d3c64243f2bc1814fce84781a68c0f159db8c-ol8_x86_64_appstream
mod_auth_openidc-2.4.9.4-9.module+el8.10.0+91088+2d069dc4.src.rpmb515a7e12036d3ba8c33a8234df21ffa06f8d8e1cce047e7309dcd53277ede5d-ol8_x86_64_appstream
cjose-0.6.1-6.module+el8.10.0+91088+2d069dc4.x86_64.rpm3d28fe49ebdf739137abf48e3820ee236f612b6eb05fc609eb75c133b3a994ad-ol8_x86_64_appstream
cjose-devel-0.6.1-6.module+el8.10.0+91088+2d069dc4.x86_64.rpm0b183a5a25b6fd0518534c6639f512145c97df5705fc161497210da35fd5a4b2-ol8_x86_64_appstream
mod_auth_openidc-2.4.9.4-9.module+el8.10.0+91088+2d069dc4.x86_64.rpm8b2f6070f875b93f42b927eb7f07bb468da470141dd5b168ccb6377b74a3b492-ol8_x86_64_appstream



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete