PT-2024-14854 · Opensc+10 · Opensc+10

Eyal Ronen + 2 · Published 2023-11-28 · Updated 2025-09-05 · CVE-2023-5992

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSC (affected versions not specified)

Description A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant, potentially resulting in the leak of private data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

ALSA-2024:0966

ALSA-2024:0967

ALSA-2024_0966

ALSA-2024_0967

ALT-PU-2024-14487

ALT-PU-2024-7018

ALT-PU-2025-1282

AZL-34088

AZL-35077

BDU:2025-07729

CESA-2024_0967

CVE-2023-5992

DLA-4004-1

INFSA-2024_0966

MGASA-2024-0101

OPENSUSE-SU-2024:13765-1

OPENSUSE-SU-2024_1402-1

RHSA-2024:0966

RHSA-2024:0967

RHSA-2024_0966

RHSA-2024_0967

SUSE-SU-2024:1402-1

SUSE-SU-2024:1402-2

SUSE-SU-2024:1625-1

SUSE-SU-2024:1773-1

SUSE-SU-2024_1402-1

SUSE-SU-2024_1625-1

SUSE-SU-2025:02754-1

SUSE-SU-2025:20530-1

SUSE-SU-2025:20671-1

SUSE-SU-2025_02754-1

USN-7346-1

USN-7346-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Opensc

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 97

• 🔥 https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992 · Exploit
• 🔥 https://usenix.org/system/files/usenixsecurity24-shagam.pdf · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2023-5992 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45617 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45616 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0101 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:0967 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0411SE18 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-40661 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7346-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1625-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45620 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-5992 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ · Vendor Advisory