Summary
[0.20.0-7]
- Fix file caching with different offsets (RHEL-4077)
- Fix CVE-2023-40660: Potential PIN bypass
- Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init
- Fix CVE-2023-5992: Marvin: Side-channel leaks while stripping encryption PKCS#1.5 padding
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | opensc | 0:0.20.0-7.el8_9 |
Vulnerabilities 2
-
Medium 6.6
Opensc: potential pin bypass when card tracks its own login state
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, par…
-
Medium 5.4
Opensc: multiple memory issues with pkcs15-init (enrollment tool)
Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the…