[El-errata] ELSA-2026-75573 Important: Oracle Linux 8 pki-core:10.6 security update

Fri Oct 9 18:25:38 UTC 2026

Oracle Linux Security Advisory ELSA-2026-75573

http://linux.oracle.com/errata/ELSA-2026-75573.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
idm-jss-4.11.0-1.module+el8.10.0+90362+5113f0b5.x86_64.rpm
idm-jss-javadoc-4.11.0-1.module+el8.10.0+90362+5113f0b5.x86_64.rpm
idm-ldapjdk-4.24.0-1.module+el8.10.0+90362+5113f0b5.noarch.rpm
idm-ldapjdk-javadoc-4.24.0-1.module+el8.10.0+90362+5113f0b5.noarch.rpm
idm-pki-acme-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-base-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-base-java-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-ca-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-kra-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-server-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-symkey-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.x86_64.rpm
idm-pki-tools-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.x86_64.rpm
idm-tomcatjss-7.8.0-1.module+el8.10.0+90362+5113f0b5.noarch.rpm
python3-idm-pki-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
resteasy-3.0.26-7.module+el8.10.0+90362+5113f0b5.noarch.rpm
resteasy-javadoc-3.0.26-7.module+el8.10.0+90362+5113f0b5.noarch.rpm

aarch64:
idm-jss-4.11.0-1.module+el8.10.0+90362+5113f0b5.aarch64.rpm
idm-jss-javadoc-4.11.0-1.module+el8.10.0+90362+5113f0b5.aarch64.rpm
idm-ldapjdk-4.24.0-1.module+el8.10.0+90362+5113f0b5.noarch.rpm
idm-ldapjdk-javadoc-4.24.0-1.module+el8.10.0+90362+5113f0b5.noarch.rpm
idm-pki-acme-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-base-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-base-java-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-ca-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-kra-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-server-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
idm-pki-symkey-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.aarch64.rpm
idm-pki-tools-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.aarch64.rpm
idm-tomcatjss-7.8.0-1.module+el8.10.0+90362+5113f0b5.noarch.rpm
python3-idm-pki-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.noarch.rpm
resteasy-3.0.26-7.module+el8.10.0+90362+5113f0b5.noarch.rpm
resteasy-javadoc-3.0.26-7.module+el8.10.0+90362+5113f0b5.noarch.rpm

SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/jss-4.11.0-1.module+el8.10.0+90362+5113f0b5.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/ldapjdk-4.24.0-1.module+el8.10.0+90362+5113f0b5.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/pki-core-10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/resteasy-3.0.26-7.module+el8.10.0+90362+5113f0b5.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/tomcatjss-7.8.0-1.module+el8.10.0+90362+5113f0b5.src.rpm

Related CVEs:

CVE-2026-76561

Description of changes:

jss
[4.11.0-1]
- Rebase to JSS 4.11.0

[4.10.0-0.1]
- Rebase to JSS 4.10.0-alpha1

[4.9.8-1]
- Rebase to JSS 4.9.8

[4.9.4-1]
- Rebase to JSS 4.9.4
- Bug 2013674 - JSS cannot be properly initialized after using another NSS-backed security provider

[4.9.3-1]
- Rebase to JSS 4.9.3
- Bug 2046022 - CVE-2021-4213 pki-core:10.6/jss: memory leak in TLS connection leads to OOM [rhel-8]

[4.9.2-1]
- Rebase to JSS 4.9.2

[4.9.1-1]
- Rebase to JSS 4.9.1

[4.9.0-1]
- Rebase to JSS 4.9.0

[4.9.0-0.2]
- Rebase to JSS 4.9.0-alpha2

[4.9.0-0.1]
- Rebase to JSS 4.9.0-alpha1

ldapjdk
[4.24.0-1]
- Rebase to LDAP SDK 4.24.0

[4.24.0-0.1]
- Rebase to LDAP SDK 4.24.0-alpha1

[4.23.0-1]
- Rebase to LDAP SDK 4.23.0

[4.23.0-0.1]
- Rebase to LDAP SDK 4.23.0-alpha1

[4.22.0-1]
- Rebase to LDAP SDK 4.22.0

[4.21.0-2]
- Bump min required JSS version to 4.6.0

[4.21.0-1]
- Rebase to LDAP SDK 4.21.0

[4.20.0-0]
- Rebase to LDAP SDK 4.20.0

pki-core
[10.15.1-3.0.1]
- Remove upstream reference

[10.15.1-3]
- RHEL-245455 CVE-2026-76561 pki-core: ExternalProcessConstraint executable allow-list
  (10.15.1 adaptation by Alessandro Garagna <agaragna at redhat.com>)

[10.15.1-2]
- Bug RHEL-141365 - Install replica fails when LDAP/DIRSRV Server certs are signed by an External CA

[10.15.1-1]
- Rebase to PKI 10.15.1
- Fix CVE 2023-4727

[10.15.0-1]
- Rebase to PKI 10.15.0

[10.15.0-0.1]
- Rebase to PKI 10.15.0-alpha1

[10.14.3-2]
- Replace pki-servlet-engine with tomcat

[10.14.3-1]
- Rebase to PKI 10.14.3
- Bug 1959057 - An error has ocorred (IPA Error 4301:CertificateOperationError)
- Bug 2016164 - IdM Install fails on RHEL 8.5 Beta when DISA STIG is applied
- Bug 2022561 - ipa-healthcheck CADogtagCertsConfigCheck fail to process the scenario of renewed IPA CA certificates ( ipa get_cert_from_db() )

[10.14.2-1]
- Rebase to PKI 10.14.2
- Bug 2149253 - Rebase to upstream version v2.14.2

[10.12.0-4]
- Bug 2107334 - CVE-2022-2414 access to external entities when parsing XML can lead to XXE
- Rename packages to idm-pki

resteasy
[3.0.26-7]
- RHEL-16724: Replace pki-servlet-4.0-api with tomcat-servlet-4.0-api

[3.0.26-6]
- CVE-2020-1695: Improper validation of response header in MediaTypeHeaderDelegate.java class
  Resolves: rh-bz#1845548

[3.5.1-3]
- Avoid redundant jcip-annotations dependency

[3.5.1-2]
- Use servlet-api from pki-servlet-container package

[3.5.1-1]
- Switch to JBoss sources and build Jackson 2 provider instead of Jackson 1

[3.0.19-8]
- Minimize to contain just components needed by pki-core

[3.0.19-7]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[3.0.19-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[3.0.19-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[3.0.19-4]
- build fix for netty 3.10.6.Final

tomcatjss
[7.8.0-1]
- Rebase to TomcatJSS 7.8.0

[7.8.0-0.1]
- Rebase to TomcatJSS 7.8.0-alpha1

[7.7.3-1]
- Replace pki-servlet-engine with tomcat

[7.7.1-1]
- Rebase to TomcatJSS 7.7.1

[7.7.0-1]
- Rebase to TomcatJSS 7.7.0

[7.7.0-0.1]
- Rebase to TomcatJSS 7.7.0-alpha1

[7.6.1-1]
- Rebase to TomcatJSS 7.6.1

[7.6.0-2]
- Bump dependency to JSS 4.8.0
- Remove unsupported platforms

[7.6.0-1]
- Rebase to TomcatJSS 7.6.0

[7.5.0-1]
- Rebase to TomcatJSS 7.5.0