ELSA-2023-7876

Опубликовано: 18 дек. 2023

Источник: oracle-oval

Платформа: Oracle Linux 8

Описание

ELSA-2023-7876: opensc security update (MODERATE)

[0.20.0-7]

Fix file caching with different offsets (RHEL-4077)
Fix CVE-2023-40660: Potential PIN bypass
Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init
Fix CVE-2023-5992: Marvin: Side-channel leaks while stripping encryption PKCS#1.5 padding

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

opensc

0.20.0-7.el8_9

Oracle Linux x86_64

opensc

0.20.0-7.el8_9

Связанные CVE

CVE-2023-40661

CVE-2023-40660

Ссылки на источники

Связанные уязвимости

SUSE-SU-2023:4104-1

suse-cvrf

больше 1 года назад

Security update for opensc

SUSE-SU-2023:4089-1

suse-cvrf

больше 1 года назад

Security update for opensc

ROS-20240402-21

CVSS3: 6.6

redos

около 1 года назад

Множественные уязвимости opensc

ELSA-2023-7879

oracle-oval

больше 1 года назад

ELSA-2023-7879: opensc security update (MODERATE)

CVE-2023-40660

CVSS3: 6.6

ubuntu

больше 1 года назад

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.