Red Hat Security Advisory

RHSA-2023:7879

opensc security update

Released 2023-12-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 9) opensc-0.23.0-3.el9_3

Fixes 3 records

TI-2023-21453 CVE-2023-40660 · GHSA-7635-x5f9-5458

Opensc: potential pin bypass when card tracks its own login state

LOW 33

A flaw was found in OpenSC packages that allow a potential PIN bypass.

CVSS 3.1MEDIUM 6.6 Physical No auth User interaction EPSS 0.01038 Published 2023-11-06 Partial fix · 0.24.0, 0.20.0-7.el8_9 +1 CWE-287

TI-2023-21454 CVE-2023-40661 · GHSA-2c2j-2pgv-gfgc

Opensc: multiple memory issues with pkcs15-init (enrollment tool)

LOW 31

Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards.

CVSS 3.1MEDIUM 6.4 Physical Low privileges User interaction EPSS 0.01318 Published 2023-11-06 Partial fix · 0.24.0, 0.20.0-7.el8_9 +1 CWE-119

TI-2023-04181 CVE-2023-4535 · GHSA-phh2-j3h6-vqr9

Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

LOW 21

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption.

CVSS 3.1MEDIUM 4.5 Physical No auth User interaction EPSS 0.00487 Published 2023-11-06 Fixed in 0.23.0-3.el9_3 CWE-125