OpenSC: Side-channel leaks while stripping encryption PKCS#1 padding
Summary
ALSA-2024:0967: Moderate: opensc security update. Affects opensc versions < 0.20.0-8.el8_9. Fixed in 0.20.0-8.el8_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSC is a set of libraries and utilities that provide support for working with smart cards. It focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. The OpenSC package is vulnerable to a side-channel leakage issue while stripping encryption PKCS#1 padding.
Vulnerability Detail
The vulnerability in OpenSC arises from side-channel leaks during the process of stripping encryption PKCS#1 padding. This can potentially lead to the exposure of sensitive information. Attackers could exploit this vulnerability to gather cryptographic keys or other confidential data, compromising the security of the system. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
0.20.0-8.el8_9
This is the first release that contains the fix.
sudo dnf update openscTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The OpenSC package is vulnerable to side-channel leaks while stripping encryption PKCS#1 padding. It is recommended to update to the latest version of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opensc →
FAQ
OpenSC is a set of libraries and utilities that provide support for working with smart cards, focusing on cards that support cryptographic operations.
The vulnerability in OpenSC can lead to side-channel leaks, potentially exposing sensitive information and compromising system security. The impact is considered moderate.
Attackers can exploit this vulnerability to gather cryptographic keys or other confidential data by leveraging the side-channel leakage issue in OpenSC.
To fix this vulnerability, update the OpenSC package to version 0.20.0-8.el8_9 or later, which includes the necessary security patches.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for opensc.
