Skip to content
OpenAdvisories
Medium ALAS2023-2023-207 1 CVE

Moderate: opensc security update (Amazon Linux 2023)

Published Jun 7, 2023 · Updated Jun 12, 2023

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2977: A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 opensc 0:0.23.0-3.amzn2023.0.1
Amazon Linux · 2023 opensc-debuginfo 0:0.23.0-3.amzn2023.0.1
Amazon Linux · 2023 opensc-debugsource 0:0.23.0-3.amzn2023.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-2977.html