Low: opensc security and bug fix update
Summary
ALSA-2023:7160: Low: opensc security and bug fix update. Affects opensc versions < 0.20.0-6.el8. Fixed in 0.20.0-6.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSC is a set of libraries and utilities that provide support for working with smart cards. It focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. The OpenSC package is vulnerable to a buffer overrun vulnerability in the pkcs15 cardos_have_verifyrc_package function.
Vulnerability Detail
The buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package (CVE-2023-2977) allows an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or a denial of service. The impact of this vulnerability can vary depending on the specific usage of the OpenSC package and the privileges of the user. It is important to update to the fixed version to mitigate the risk.
How To Fix
Minimum fixed version
0.20.0-6.el8
This is the first release that contains the fix.
sudo dnf update openscTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The OpenSC package has a buffer overrun vulnerability that can potentially lead to arbitrary code execution or a denial of service. It is crucial to update to the fixed version (0.20.0-6.el8 or later) to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for opensc →
FAQ
OpenSC is a set of libraries and utilities for working with smart cards that support cryptographic operations.
The impact can vary depending on the specific usage and privileges, but it could potentially lead to arbitrary code execution or a denial of service.
To fix this vulnerability, update the OpenSC package to version 0.20.0-6.el8 or later.
No specific workarounds have been mentioned for this vulnerability.
You can find more information about this vulnerability in the CVE page(s) listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for opensc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
