Lucene search

[email protected]CVE-2023-4535

HistoryNov 06, 2023 - 5:15 p.m.

CVE-2023-4535

2023-11-0617:15:12

CWE-125

[email protected]

web.nvd.nist.gov

cve-2023-4535

opensc

myeid

out-of-bounds read

symmetric key encryption

physical access

usb device

smart card

security vulnerability

4.5 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

4.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.1%

JSON

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system’s security.

Affected configurations

NVD

Node

opensc_projectopenscMatch0.23.0-

opensc_projectopenscMatch0.23.0rc1

opensc_projectopenscMatch0.23.0rc2

Node

fedoraprojectfedoraMatch38

fedoraprojectfedoraMatch39

redhatenterprise_linuxMatch9.0

CPENameOperatorVersion
opensc_project:openscopensc project opensceq0.23.0

CPE	Name	Operator	Version
opensc_project:opensc	opensc project opensc	eq	0.23.0

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "opensc",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:0.23.0-3.el9_3",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9::baseos"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "opensc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "opensc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ]
  }
]