TI-2026-38908 CVE-2026-53939
OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
Priority HIGH 80
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE).
RHSA-2026:92160
mod_auth_openidc:2.3 security update
Released 2026-10-29 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.4) cjose-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.x86_64::mod_auth_openidc:2.3 +2
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) cjose-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.x86_64::mod_auth_openidc:2.3 +2