OpenSC: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• Medium 6.6
  CVE-2023-40660

  Opensc: potential pin bypass when card tracks its own login state

  A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, par…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 6, 2023
• Medium 5.4
  CVE-2023-40661

  Opensc: multiple memory issues with pkcs15-init (enrollment tool)

  Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 6, 2023
• Medium 4.5
  CVE-2023-4535

  Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

  An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Azure Linux Alpine
  Nov 6, 2023

Revision history

1. 2025-04-09 #14

   Neue Updates von Ubuntu aufgenommen

2. 2025-03-30 #13

   Neue Updates von Ubuntu aufgenommen

3. 2025-03-11 #12

   Neue Updates von Ubuntu aufgenommen

4. 2024-12-29 #11

   Neue Updates von Debian aufgenommen

5. 2024-12-10 #10

   Neue Updates von Gentoo aufgenommen

6. 2023-12-19 #9

   Neue Updates von Oracle Linux aufgenommen

7. 2023-12-18 #8

   Neue Updates von Red Hat aufgenommen

8. 2023-12-17 #7

   Neue Updates von Red Hat aufgenommen

9. 2023-12-14 #6

   Neue Updates von Fedora aufgenommen

10. 2023-11-26 #5

    Neue Updates von Debian aufgenommen

11. 2023-11-02 #4

    Neue Updates von Amazon aufgenommen

12. 2023-10-17 #3

    Neue Updates von SUSE aufgenommen

13. 2023-10-16 #2

    Neue Updates von SUSE aufgenommen

14. 2023-09-27 #1

    Initiale Fassung

References

• OpenSC Security Advisories vom 2023-09-25
  https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories
• SUSE Security Update SUSE-SU-2023:4089-1 vom 2023-10-16
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016692.html
• SUSE Security Update SUSE-SU-2023:4104-1 vom 2023-10-17
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016707.html
• Amazon Linux Security Advisory ALAS2-2023-2323 vom 2023-11-02
  https://alas.aws.amazon.com/AL2/ALAS-2023-2323.html
• Debian Security Advisory DLA-3668 vom 2023-11-27
  https://lists.debian.org/debian-lts-announce/2023/11/msg00024.html
• Fedora Security Advisory FEDORA-2023-C7E4C9AF51 vom 2023-12-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-c7e4c9af51
• Fedora Security Advisory FEDORA-2023-A854153D7A vom 2023-12-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-a854153d7a
• Red Hat Security Advisory RHSA-2023:7879 vom 2023-12-18
  https://access.redhat.com/errata/RHSA-2023:7879
• Red Hat Security Advisory RHSA-2023:7876 vom 2023-12-19
  https://www.cybersecurity-help.cz/vdb/SB2023121913
• Oracle Linux Security Advisory ELSA-2023-7879 vom 2023-12-19
  https://linux.oracle.com/errata/ELSA-2023-7879.html
• Oracle Linux Security Advisory ELSA-2023-7876 vom 2023-12-19
  https://linux.oracle.com/errata/ELSA-2023-7876.html
• Gentoo Linux Security Advisory GLSA-202412-15 vom 2024-12-11
  https://security.gentoo.org/glsa/202412-15
• Debian Security Advisory DLA-4004 vom 2024-12-28
  https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
• Ubuntu Security Notice USN-7346-1 vom 2025-03-12
  https://ubuntu.com/security/notices/USN-7346-1
• Ubuntu Security Notice USN-7346-2 vom 2025-03-28
  https://ubuntu.com/security/notices/USN-7346-2
• Ubuntu Security Notice USN-7346-3 vom 2025-04-10
  https://ubuntu.com/security/notices/USN-7346-3