PT-2019-6153 · Opensc+7 · Opensc+7

Published 2019-09-05 · Updated 2024-06-15 · CVE-2019-15945

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.20.0-rc1

Description The issue is related to an out-of-bounds access of an ASN.1 Bitstring in the decode bit string function in libopensc/asn1.c. This can allow an attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 0.20.0-rc1, update to version 0.20.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to the decode bit string function in libopensc/asn1.c until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2020-1884

ALT-PU-2020-2900

BDU:2022-00268

CESA-2020_4483

CVE-2019-15945

DLA-1916-1

DLA-2832-1

MGASA-2020-0026

OPENSUSE-SU-2021:0565-1

OPENSUSE-SU-2021_0565-1

OPENSUSE-SU-2024:11123-1

RHSA-2020:4483

RHSA-2020_4483

SUSE-SU-2021:0998-1

SUSE-SU-2021:1168-1

SUSE-SU-2021_0998-1

SUSE-SU-2021_1168-1

SUSE-SU-2022:1041-1

SUSE-SU-2022_1041-1

USN-5281-1

Affected Products

Alt Linux

Astra Linux

Centos

Linuxmint

Opensc

Red Hat

Suse

Ubuntu

References · 87

• https://github.com/OpenSC/OpenSC/commit/412a6142c27a5973c61ba540e33cdc22d5608e68 · Patch
• https://github.com/OpenSC/OpenSC/compare/f1691fc...12218d4 · Patch
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5281-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15945 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4483.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-5281-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15945 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1916-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2832-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0565-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-15945 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0026 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0026.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:1168-1 · Vendor Advisory