The NSS cryptographic toolkit packages are updated to version 3.101 to provide many bug fixes and enhancements, including an important fix to prevent RSA certificates with keys shorter than 2048 bits from working, in accordance with the system-wide cryptographic policy.

OpenSSL is updated to version 3.2.2. This significant update includes many feature changes, security fixes, and changes.

OpenSSH is updated to version 8.7p1-43. This update patches several critical security issues and includes performance enhancements and bug fixes.

#SSH_RSA_BITS=3072
#SSH_ECDSA_BITS=256

The OpenSSL hash links to trusted CA root certificates are populated in /etc/pki/ca-trust/extracted/pem/directory-hash/. This update helps OpenSSL to perform certificate lookup and validation more efficiently when the SSL_CERT_DIR environment variable is set to the file path of the directory-hash.

The crypto-policies packages are updated for algorithm selection in Java. The update includes the following changes:

• DTLS 1.0 is controlled by the protocol option, which is disabled by default. You can enable it by setting the protocol@java = DTLS1.0+ scoped directive.

• anon and NULL cipher suites are controlled by setting the cipher option, which is disabled by default. For example, set the cipher@java = NULL scoped directive.

• The list of signature algorithms is controlled by the sign@java scoped directive and aligned to the system-wide defaults. You can specify algorithms for Java with a sign@java = <algorithm1>+ <algorithm2>+ scoped directive.

• Elliptic curve (EC) keys smaller than 256 bits are disabled unconditionally to align with upstream guidance.

For information on interoperability see the /etc/crypto-policies/back-ends/java.config file.

The fips-mode-setup command checks open LUKS volumes for Argon2 key derivation functions (KDF) before switching to FIPS mode, and exits if any are detected. Argon2 KDF isn't FIPS compatible. This update helps prevent application of FIPS mode on systems that contain volumes that aren't FIPS compliant. Change KDFs on any volumes that are affected.

The audit package is updated to version 3.1.5 to fix several bugs including some fixes for memory leaks, and improvement to auparse metrics and a manual page update to clarify /etc/audit/audit-stop.rules.

The opencryptoki package is updated to version 3.23.0.

Notable changes include several bug fixes, updates to harden against RSA timing attacks, and EP11 enables FIPS-session mode.

See https://github.com/opencryptoki/opencryptoki/releases for more information.

The libreswan packages are updated to version 4.15 to provide security fixes and improvements.

See https://github.com/libreswan/libreswan/blob/main/CHANGES for more information.

Libreswan is also updated to resolve an issue that caused an IPsec connection to fail when configured to use certificate-based authentication with a certificate that included a subjectAltName extension with an IPv6 address.

The clevis component that's used to automate decryption of data or LUKS volumes is updated to version 20.

See https://github.com/latchset/clevis/releases/tag/v19 and https://github.com/latchset/clevis/releases/tag/v20 for more information.

The jose package is updated to version 14. jose is a command line utility for performing various tasks on JSON Object Signing and Encryption (JOSE) objects. jose provides a full crypto stack including key generation, signing, and encryption.

See https://github.com/latchset/jose/releases/tag/v12, https://github.com/latchset/jose/releases/tag/v13, and https://github.com/latchset/jose/releases/tag/v14 for more information.

Several significant updates are applied for SELinux in this release.

• The afterburn_t, bootupd_t, rshim_t, and mptcpd_t SELinux domains are updated so that the associated services run in enforcing mode.

• The bootupd service updates the bootloader, and therefore must be confined. The bootupd service runs in the bootupd_t SELinux domain.

• The SELinux policy is updated by new rules in the nbdkit-selinux package to confine nbdkit so that systems that run nbdkit are more resilient against privilege escalation attacks.

• A new SELinux policy Boolean is added to allow the QEMU guest agent to change to the virt_qemu_ga_unconfined_t domain for run files in any of the following directories:

  • /etc/qemu-ga/fsfreeze-hook.d/

  • /usr/libexec/qemu-ga/fsfreeze-hook.d/

  • /var/run/qemu-ga/fsfreeze-hook.d/

  Enable the virt_qemu_ga_run_unconfined to run confined commands through the QEMU guest agent.

Updates to the SCAP Security Guide include the following notable changes:

• Enhanced coverage of draft for STIG profile in Oracle Linux 9:

  • Extended rules selection to match latest version of the draft document.

  • Completed ansible remediation coverage.

• Introduced ism_o profile for Oracle Linux 9 systems to cover the "Information Security Manual" guidance produced by Australian Cyber Security Center.