Moderate: opensc security update
Summary
ALSA-2024:0966: Moderate: opensc security update. Affects opensc versions < 0.23.0-4.el9_3. Fixed in 0.23.0-4.el9_3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSC is a set of libraries and utilities that provide support for working with smart cards. It focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. OpenSC is widely used in various applications and systems.
Vulnerability Detail
The vulnerability in OpenSC, identified as CVE-2023-5992, involves side-channel leaks while stripping encryption PKCS#1 padding. This vulnerability could potentially allow an attacker to extract sensitive information from the smart card, compromising the security of authentication, mail encryption, or digital signatures performed using OpenSC.
How To Fix
Minimum fixed version
0.23.0-4.el9_3
This is the first release that contains the fix.
sudo dnf update openscTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The OpenSC package has a moderate security vulnerability (CVE-2023-5992) related to side-channel leaks during encryption PKCS#1 padding stripping. It is crucial to update to version 0.23.0-4.el9_3 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for opensc →
FAQ
OpenSC is a set of libraries and utilities that provide support for working with smart cards, enabling authentication, mail encryption, and digital signatures.
This vulnerability could allow an attacker to extract sensitive information from smart cards, compromising the security of authentication, mail encryption, or digital signatures.
To fix this vulnerability, update the opensc package to version 0.23.0-4.el9_3 or later.
No specific workarounds have been mentioned for this vulnerability.
You can find more information about this vulnerability in the CVE page(s) listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for opensc.
