CVE-2023-40661

CVSS V2 None CVSS V3 None

Description

Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise key generation, certificate loading, and other card management operations during enrollment.

Overview

CVE ID
CVE-2023-40661

Assigner
redhat

Vulnerability Status
PUBLISHED

Published Version
2023-11-06T16:58:43.029Z

Last Modified Date
2024-05-01T20:21:02.210Z

Weakness Enumerations

CWE	URL
CWE-119	http://cwe.mitre.org/data/definitions/119.html

References

Reference URL	Reference Tags
http://www.openwall.com/lists/oss-security/2023/12/13/3
https://access.redhat.com/errata/RHSA-2023:7876	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7879	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-40661	vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2240913	issue-tracking x_refsource_REDHAT
https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651
https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1
https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories
https://lists.debian.org/debian-lts-announce/2023/11/msg00024.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CPQOMCDWFRBMEFR5VK4N5MMXXU42ODE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLYEFIBBA37TK3UNMZN5NOJ7IWCIXLQP/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-40661
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40661

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 02:21:54				Added to TrackCVE