PT-2019-15852 · Opensc+2 · Opensc+2

Published 2019-12-01 · Updated 2024-06-15 · CVE-2019-19480

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSC versions 0.19.0 and earlier OpenSC versions 0.20.x through 0.20.0-rc3

Description An issue was discovered in the libopensc/pkcs15-prkey.c file, where there is an incorrect free operation in the sc pkcs15 decode prkdf entry function.

Recommendations For OpenSC versions 0.19.0 and earlier, update to a version later than 0.19.0 to resolve the issue. For OpenSC versions 0.20.x through 0.20.0-rc3, update to a version later than 0.20.0-rc3 to resolve the issue. As a temporary workaround, consider restricting access to the sc pkcs15 decode prkdf entry function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-672

Related Identifiers

ALT-PU-2020-1884

ALT-PU-2020-2900

CVE-2019-19480

MGASA-2020-0026

OPENSUSE-SU-2021:0565-1

OPENSUSE-SU-2021_0565-1

OPENSUSE-SU-2024:11123-1

SUSE-SU-2021:1168-1

Affected Products

Alt Linux

Opensc

Suse

References · 47

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18478 · Exploit
• https://github.com/OpenSC/OpenSC/commit/6ce6152284c47ba9b1d4fe8ff9d2e6a3f5ee02c7 · Patch
• https://advisories.mageia.org/MGASA-2020-0026.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-19480 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0565-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11123-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19480 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1168-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDSQLMZZYBHO5X3BK7D6E7E6NZIMZDI5 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0026 · Vendor Advisory
• https://github.com/OpenSC/OpenSC/releases/tag/0.20.0 · Note
• https://bugs.mageia.org/show_bug.cgi?id=25975 · Note
• https://suse.com/security/cve/CVE-2018-16426 · Note
• https://suse.com/security/cve/CVE-2019-6502 · Note
• https://suse.com/security/cve/CVE-2018-16420 · Note