Low: opensc security update - Buffer Overrun Vulnerability in pkcs15 cardos_have_verifyrc_package
Summary
ALSA-2023:6587: Low: opensc security update. Affects opensc versions < 0.23.0-2.el9. Fixed in 0.23.0-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSC is a set of libraries and utilities that provide support for working with smart cards. It focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. The OpenSC package is vulnerable to a buffer overrun vulnerability in the pkcs15 cardos_have_verifyrc_package function.
Vulnerability Detail
The buffer overrun vulnerability in the pkcs15 cardos_have_verifyrc_package function of OpenSC can be exploited by an attacker to execute arbitrary code or cause a denial of service. This vulnerability may allow an attacker to gain unauthorized access, manipulate data, or disrupt the normal operation of the affected system. The vulnerability is identified as CVE-2023-2977.
How To Fix
Minimum fixed version
0.23.0-2.el9
This is the first release that contains the fix.
sudo dnf update openscTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The OpenSC package is vulnerable to a buffer overrun vulnerability in the pkcs15 cardos_have_verifyrc_package function. To mitigate this vulnerability, users should update the OpenSC package to version 0.23.0-2.el9 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for opensc →
FAQ
OpenSC is a set of libraries and utilities that provide support for working with smart cards. It focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures.
The buffer overrun vulnerability in OpenSC can be exploited by an attacker to execute arbitrary code or cause a denial of service. This may allow unauthorized access, data manipulation, or disruption of the affected system.
The CVE identifier for this vulnerability is CVE-2023-2977.
To fix this vulnerability, update the OpenSC package to version 0.23.0-2.el9 or later using the package manager of your AlmaLinux 9 distribution.
No workaround is mentioned for this vulnerability. It is recommended to update the OpenSC package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for opensc.
