.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1 +1,4 @@
-SOURCES/opencryptoki-3.22.0.tar.gz
+SOURCES/opencryptoki-3.19.0.tar.gz
+/opencryptoki-3.19.0.tar.gz
+/opencryptoki-3.21.0.tar.gz
+/opencryptoki-3.22.0.tar.gz

.opencryptoki.metadata

@@ -1 +0,0 @@
-4618b82afde56a8177e888c26d336c6f521bed8a SOURCES/opencryptoki-3.22.0.tar.gz

CI_plan.fmf

@@ -0,0 +1,38 @@
+/tier1-tests-on-x86_64-with-swtok:
+
+  summary: opencryptoki Tier1 tests on x86_64 with swtok
+
+  tag:
+   - Tier1
+
+  discover:
+    url: https://gitlab.cee.redhat.com/rhel-tests/opencryptoki.git
+    filter: "tag:Tier1"
+    how: fmf
+    test:
+     - "Sanity/.*"
+     - "Regression/.*"
+
+  execute:
+    how: tmt
+
+/sw-token-package-update:
+
+  summary: perform opencryptoki package update on a configured SW token
+
+  prepare:
+   - how: shell
+     order: 90
+     script:
+      - dnf -y downgrade 'opencryptoki*'
+
+  discover:
+    url: https://gitlab.cee.redhat.com/rhel-tests/opencryptoki.git
+    how: fmf
+    test:
+      - /Update/initialized-sw-token/setup
+      - /Update/dnf-update-opencryptoki
+      - /Update/initialized-sw-token/test
+
+  execute:
+    how: tmt

gating.yaml

@@ -0,0 +1,7 @@
+--- !Policy
+product_versions:
+  - rhel-8
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.openstack-tier1-gating.functional}
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.beaker-tier1-gating.functional}

opencryptoki.spec

@@ -1,7 +1,7 @@
 Name: opencryptoki
 Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0
 Version: 3.22.0
-Release: 3%{?dist}.2
+Release: 3%{?dist}.3
 License: CPL
 Group: System Environment/Base
 URL: https://github.com/opencryptoki/opencryptoki
@@ -25,6 +25,8 @@ Patch24: opencryptoki-CVE-2024-0914-part5.patch
 Patch25: 3.22-CCA-Adjust-CCA-host-library-version-detection-for-ne.patch
 # CVE-3-2026-23893, symlink-following vulnerabilities
 Patch26: opencryptoki-3.20.0-CVE-3-2026-23893.patch
+# CVE-2026-40253, possible out-of-bounds access in BER decode functions
+Patch27: opencryptoki-3.20.0-CVE-2026-40253.patch
 
 Requires(pre): coreutils diffutils
 Requires: (selinux-policy >= 3.14.3-121 if selinux-policy-targeted)
@@ -385,6 +387,9 @@ fi
 
 
 %changelog
+* Tue May 19 2026 Than Ngo <than@redhat.com> - 3.22.0-3.3
+- Resolves: RHEL-171558, Fix possible out-of-bounds access in BER decode functions
+
 * Mon Mar 02 2026 Than Ngo <than@redhat.com> - 3.22.0-3.2
 - Resolves: RHEL-144817, CVE-2026-23893 Privilege Escalation or Data Exposure via Symlink Following
 

sources

@@ -0,0 +1 @@
+SHA512 (opencryptoki-3.22.0.tar.gz) = 404b32b19ef70c3e971bf6dd918fa5fa23701eff591282330085b53491597a2fb5928f800110a28dbc8a22744e00477dadadedf5cea5503984078cad38c46b25