PT-2020-16464 · Opensc+9 · Opensc+9

Published 2020-10-06 · Updated 2024-06-15 · CVE-2020-26572

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.21.0-rc1

Description The issue is related to a stack-based buffer overflow in the tcos decipher function of the TCOS smart card software driver in OpenSC.

Recommendations For OpenSC versions prior to 0.21.0-rc1, update to version 0.21.0-rc1 or later to resolve the issue. As a temporary workaround, consider disabling the tcos decipher function until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2021:1600

ALT-PU-2020-3387

ALT-PU-2020-3431

ALT-PU-2023-1834

AZL-6774

CESA-2021_1600

CVE-2020-26572

DLA-2832-1

MGASA-2021-0037

OESA-2021-1063

OPENSUSE-SU-2021:0565-1

OPENSUSE-SU-2021_0565-1

OPENSUSE-SU-2024:11123-1

RHSA-2021:1600

RHSA-2021_1600

RLSA-2021:1600

SUSE-SU-2021:0998-1

SUSE-SU-2021:1168-1

SUSE-SU-2022:1041-1

USN-5281-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Opensc

Red Hat

Rocky Linux

Suse

Ubuntu

References · 96

• https://github.com/OpenSC/OpenSC/commit/9d294de90d1cc66956389856e60b6944b27b4817 · Patch
• https://osv.dev/vulnerability/AZL-6774 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1041-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1168-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5281-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2832-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26572 · Security Note
• https://advisories.mageia.org/MGASA-2021-0037.html · Security Note
• https://ubuntu.com/security/CVE-2019-15946 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15945 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5281-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26572 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26572 · Security Note
• https://ubuntu.com/security/CVE-2020-26570 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26572 · Vendor Advisory