CVE-2019-6502 Denial of service in n/a
A memory leak in OpenSC's context creation allows attackers to exhaust system memory, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-6502?
CVE-2019-6502 is a high-severity denial of service vulnerability in Opensc Project Opensc, published on 22 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv.
Weakness: CWE-401
Which versions are affected by CVE-2019-6502?
It affects 1 product.
Linux distribution packages (7)
opensc SUSE:Linux Enterprise Micro 5.1 | All versions | 0.19.0-150100.3.19.1 |
opensc SUSE:Linux Enterprise Micro 5.2 | All versions | 0.19.0-150100.3.19.1 |
opensc SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 0.19.0-150100.3.19.1 |
opensc SUSE:Linux Enterprise Server 12 SP5 | All versions | 0.13.0-3.6.27 |
opensc SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 0.13.0-3.6.27 |
opensc openSUSE:Leap 15.3 | All versions | 0.19.0-150100.3.19.1 |
opensc openSUSE:Leap Micro 5.2 | All versions | 0.19.0-150100.3.19.1 |
Products include Opensc Project Opensc.
How do I fix CVE-2019-6502?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-6502 being exploited?
There is no known exploitation of CVE-2019-6502 in the wild and no public exploit code.
Other vulnerabilities in Opensc Project Opensc
Sources
Also known as DEBIAN-CVE-2019-6502, GHSA-wfg8-cwx5-w8xc, SUSE-SU-2020:3133-1, SUSE-SU-2022:4196-1, UBUNTU-CVE-2019-6502.