Summary
The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures.
Security Fix(es):
* OpenSC: Potential PIN bypass when card tracks its own login state (CVE-2023-40660)
* OpenSC: multiple memory issues with pkcs15-init (enrollment tool) (CVE-2023-40661)
* OpenSC: out-of-bounds read in MyEID driver handling encryption using symmetric keys (CVE-2023-4535)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | opensc | 0.23.0-3.el9_3 |
Vulnerabilities 3
-
Medium 6.6
Opensc: potential pin bypass when card tracks its own login state
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, par…
-
Medium 5.4
Opensc: multiple memory issues with pkcs15-init (enrollment tool)
Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the…
-
Medium 4.5
Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-40660
-
report
https://access.redhat.com/security/cve/CVE-2023-40661
-
report
https://access.redhat.com/security/cve/CVE-2023-4535
-
report
https://bugzilla.redhat.com/2240912
-
report
https://bugzilla.redhat.com/2240913
-
report
https://bugzilla.redhat.com/2240914
-
advisory
https://errata.almalinux.org/9/ALSA-2023-7879.html