Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40661: multiple memory issues with pkcs15-init (enrollment tool) CVE-2023-40660: Potential PIN bypass. When the token/card was plugged into the computer and authenticated from one process, it could be used to provide cryptographic operations from different process when the empty, zero-length PIN and the token can track the login status using some of its internals. This is dangerous for OS logon/screen unlock and small tokens that are plugged permanently to the computer.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | opensc | 0:0.19.0-5.amzn2.0.2 |
| Amazon Linux · 2 | opensc-debuginfo | 0:0.19.0-5.amzn2.0.2 |
Vulnerabilities 2
-
Medium 6.6
Opensc: potential pin bypass when card tracks its own login state
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, par…
-
Medium 5.4
Opensc: multiple memory issues with pkcs15-init (enrollment tool)
Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the…