rpm package
almalinux/opensc
pkg:rpm/almalinux/opensc
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-5992 | — | < 0.23.0-4.el9_3 | 0.23.0-4.el9_3 | Jan 31, 2024 | A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data. | ||
| CVE-2023-40661 | — | < 0.20.0-7.el8_9 | 0.20.0-7.el8_9 | Nov 6, 2023 | Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and | ||
| CVE-2023-40660 | — | < 0.20.0-7.el8_9 | 0.20.0-7.el8_9 | Nov 6, 2023 | A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logo | ||
| CVE-2023-4535 | — | < 0.23.0-3.el9_3 | 0.23.0-3.el9_3 | Nov 6, 2023 | An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows th | ||
| CVE-2023-2977 | — | < 0.23.0-2.el9 | 0.23.0-2.el9 | Jun 1, 2023 | A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags | ||
| CVE-2020-26570 | — | < 0.20.0-4.el8 | 0.20.0-4.el8 | Oct 6, 2020 | The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file. | ||
| CVE-2020-26571 | — | < 0.20.0-4.el8 | 0.20.0-4.el8 | Oct 6, 2020 | The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init. | ||
| CVE-2020-26572 | — | < 0.20.0-4.el8 | 0.20.0-4.el8 | Oct 6, 2020 | The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher. |
- CVE-2023-5992Jan 31, 2024affected < 0.23.0-4.el9_3fixed 0.23.0-4.el9_3
A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.
- CVE-2023-40661Nov 6, 2023affected < 0.20.0-7.el8_9fixed 0.20.0-7.el8_9
Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and
- CVE-2023-40660Nov 6, 2023affected < 0.20.0-7.el8_9fixed 0.20.0-7.el8_9
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logo
- CVE-2023-4535Nov 6, 2023affected < 0.23.0-3.el9_3fixed 0.23.0-3.el9_3
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows th
- CVE-2023-2977Jun 1, 2023affected < 0.23.0-2.el9fixed 0.23.0-2.el9
A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags
- CVE-2020-26570Oct 6, 2020affected < 0.20.0-4.el8fixed 0.20.0-4.el8
The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.
- CVE-2020-26571Oct 6, 2020affected < 0.20.0-4.el8fixed 0.20.0-4.el8
The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.
- CVE-2020-26572Oct 6, 2020affected < 0.20.0-4.el8fixed 0.20.0-4.el8
The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.