PT-2023-8907 · Opensc+4 · Opensc+4

Tej Rathi · Publicado 2023-11-06 · Atualizado 2025-01-27 · CVE-2023-4535

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Média

Vetor base

AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenSC (affected versions not specified)

Description An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALSA-2023:7879

ALT-PU-2023-8056

ALT-PU-2023-8077

ALT-PU-2023-8185

ALT-PU-2024-7018

AZL-31945

AZL-35076

BDU:2024-02587

CVE-2023-4535

OPENSUSE-SU-2024:13314-1

RHSA-2023:7879

RHSA-2023_7879

ROSA-SA-2025-2580

Produtos afetados

Alt Linux

Almalinux

Opensc

Red Hat

Red Os

Referências · 40

• https://github.com/OpenSC/OpenSC/commit/f1993dc4e0b33050b8f72a3558ee88b24c4063b2 · Correção
• https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories · Aviso do Fabricante
• https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1 · Nota
• https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651 · Correção
• https://osv.dev/vulnerability/openSUSE-SU-2024:13314-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-4535 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-4535 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-opensc-cve-2023-40660-cve-2023-40661-cve-2023-4535 · Nota
• https://access.redhat.com/security/cve/CVE-2023-40661 · Nota
• https://suse.com/security/cve/CVE-2023-40660 · Nota
• https://bugzilla.redhat.com/2240914 · Nota
• https://bugzilla.redhat.com/2240913 · Nota
• https://osv.dev/vulnerability/AZL-31945 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4535 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure · Nota