PT-2020-16463 · Opensc+9 · Opensc+9

Published 2020-10-06 · Updated 2024-06-15 · CVE-2020-26571

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.21.0-rc1

Description The issue is a stack-based buffer overflow in the sc pkcs15emu gemsafeGPK init function of the gemsafe GPK smart card software driver.

Recommendations For versions prior to 0.21.0-rc1, update to version 0.21.0-rc1 or later to resolve the issue. As a temporary workaround, consider disabling the sc pkcs15emu gemsafeGPK init function until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2021:1600

ALT-PU-2020-3387

ALT-PU-2020-3431

ALT-PU-2023-1834

AZL-6773

CESA-2021_1600

CVE-2020-26571

DLA-2832-1

MGASA-2021-0037

OESA-2021-1063

OPENSUSE-SU-2021:0565-1

OPENSUSE-SU-2021_0565-1

OPENSUSE-SU-2024:11123-1

RHSA-2021:1600

RHSA-2021_1600

RLSA-2021:1600

SUSE-SU-2021:0998-1

SUSE-SU-2021:1168-1

SUSE-SU-2022:1041-1

USN-5281-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Opensc

Red Hat

Rocky Linux

Suse

Ubuntu

References · 95

• https://ubuntu.com/security/CVE-2020-26571 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1063 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:1600 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26571 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26571 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26571 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:1600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26572 · Security Note
• https://errata.almalinux.org/8/ALSA-2021-1600.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26571 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:1041-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0998-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1168-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26571 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXOHFDMNMO6IDECAGUTB3SJGAGXVRT6S · Vendor Advisory