PT-2020-10765 · Opensc+5 · Opensc+5

Published 2020-04-27 · Updated 2024-06-15 · CVE-2019-20792

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.20.0

Description The issue is related to a double free in coolkey free private data due to coolkey add object lacking a uniqueness check in libopensc/card-coolkey.c.

Recommendations For versions prior to 0.20.0, update to version 0.20.0 or later to resolve the issue.

Exploit

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2020-1884

ALT-PU-2020-2900

CESA-2020_4483

CVE-2019-20792

OPENSUSE-SU-2021:0565-1

OPENSUSE-SU-2021_0565-1

OPENSUSE-SU-2024:11643-1

RHSA-2020:4483

RHSA-2020_4483

SUSE-SU-2021:1168-1

SUSE-SU-2022:1041-1

Affected Products

Alt Linux

Astra Linux

Centos

Opensc

Red Hat

Suse

References · 47

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19208 · Exploit
• https://github.com/OpenSC/OpenSC/commit/c246f6f69a749d4f68626b40795a4f69168008f4 · Patch
• https://cve.org/CVERecord?id=CVE-2019-20792 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-20792 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20792 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1041-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-20792 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11643-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1168-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4483.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20792 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0565-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20792 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20792 · Vendor Advisory
• https://github.com/OpenSC/OpenSC/compare/0.19.0...0.20.0 · Note