Red Hat Security Advisory: opensc security update

Fixed packages 3

Vulnerabilities 3

• Medium 6.6
  CVE-2023-40660

  Opensc: potential pin bypass when card tracks its own login state

  A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, par…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 6, 2023
• Medium 5.4
  CVE-2023-40661

  Opensc: multiple memory issues with pkcs15-init (enrollment tool)

  Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 6, 2023
• Medium 4.5
  CVE-2023-4535

  Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

  An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Azure Linux Alpine
  Nov 6, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240912
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240913
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240914
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7879.json
• report
  https://access.redhat.com/security/cve/CVE-2023-4535
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4535
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4535
• article
  https://github.com/OpenSC/OpenSC/commit/f1993dc4e0b33050b8f72a3558ee88b24c4063b2
• article
  https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651
• article
  https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1
• article
  https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories
• report
  https://access.redhat.com/security/cve/CVE-2023-40660
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-40660
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-40660
• report
  https://access.redhat.com/security/cve/CVE-2023-40661
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-40661
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-40661