Medium severity6.6OSV Advisory· Published Nov 6, 2023· Updated Jun 17, 2026
CVE-2023-40660
CVE-2023-40660
Description
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
24- Range: 0.12.2, 0.12.2-rc1, 0.13.0, …
- osv-coords22 versionspkg:rpm/almalinux/openscpkg:rpm/opensuse/opensc&distro=openSUSE%20Tumbleweedpkg:rpm/suse/opensc&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Micro%205.1pkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4pkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5pkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/opensc&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/opensc&distro=SUSE%20Manager%20Proxy%204.2pkg:rpm/suse/opensc&distro=SUSE%20Manager%20Server%204.2
< 0.20.0-7.el8_9+ 21 more
- (no CPE)range: < 0.20.0-7.el8_9
- (no CPE)range: < 0.23.0-3.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.22.0-150400.3.6.1
- (no CPE)range: < 0.22.0-150400.3.6.1
- (no CPE)range: < 0.22.0-150400.3.6.1
- (no CPE)range: < 0.22.0-150400.3.6.1
- (no CPE)range: < 0.22.0-150400.3.6.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
- (no CPE)range: < 0.19.0-150100.3.25.1
Patches
Vulnerability mechanics
References
11- access.redhat.com/security/cve/CVE-2023-40660nvdThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue Tracking
- github.com/OpenSC/OpenSC/issues/2792nvdIssue Tracking
- github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1nvdRelease Notes
- www.openwall.com/lists/oss-security/2023/12/13/2nvd
- access.redhat.com/errata/RHSA-2023:7876nvd
- access.redhat.com/errata/RHSA-2023:7879nvd
- lists.debian.org/debian-lts-announce/2023/11/msg00024.htmlnvd
- lists.debian.org/debian-lts-announce/2024/12/msg00026.htmlnvd
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CPQOMCDWFRBMEFR5VK4N5MMXXU42ODE/nvd
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLYEFIBBA37TK3UNMZN5NOJ7IWCIXLQP/nvd
News mentions
0No linked articles in our index yet.