Yüksek CVSS 7.5

CVE-2026-2100: P11-kit: güvenlik açığı

Yayın: 27 Mart 2026 00:17 · Güncelleme: 6 Kasım 2026 10:18

Açıklama (NVD)

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

Özet bilgiler

Ürün: P11-kit Project P11-kit
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: %1,31 (yüzdelik 71)
CWE: CWE-824
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
p11-kit-project-p11-kit	—	—	0.26.2
redhat-cert-manager-operator	1.17.0	—	1.17.2
redhat-cert-manager-operator	1.18.0	—	1.18.2
redhat-cert-manager-operator	1.20.0	—	1.20.1
redhat-cost-management-metrics-operator	4.0.0	—	4.4.1
redhat-hardened-images	—	—	—
redhat-insights-proxy	1.5.0	1.5.0	—
redhat-update-infrastructure	5.0	5.0	—
redhat-enterprise-linux	6.0	6.0	—
redhat-enterprise-linux	7.0	7.0	—
redhat-enterprise-linux	8.0	8.0	—
redhat-enterprise-linux	9.0	9.0	—
redhat-enterprise-linux	10.0	10.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları