CVE-2023-5992 Opensc: side-channel leaks while stripping encryption pkcs#1 padding
OpenSC fails to implement side-channel resistant PKCS#1 padding removal, potentially leaking private data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-5992?
CVE-2023-5992 is a medium-severity vulnerability in Opensc Project Opensc, published on 31 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.
Weakness: CWE-203
Which versions are affected by CVE-2023-5992?
It affects 11 products.
Linux distribution packages (26)
opensc AlmaLinux:8 | All versions | 0.20.0-8.el8_9 |
opensc AlmaLinux:9 | All versions | 0.23.0-4.el9_3 |
opensc Red Hat:enterprise_linux:8::baseos | All versions | 0:0.20.0-8.el8_9 |
opensc-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:0.20.0-8.el8_9 |
opensc-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:0.20.0-8.el8_9 |
opensc Red Hat:enterprise_linux:9::baseos | All versions | 0:0.23.0-4.el9_3 |
opensc-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:0.23.0-4.el9_3 |
opensc-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:0.23.0-4.el9_3 |
opensc Rocky Linux:8 | All versions | 0:0.20.0-8.el8_9 |
opensc Rocky Linux:9 | All versions | 0:0.23.0-4.el9_3 |
opensc SUSE:Linux Enterprise Micro 5.1 | All versions | 0.19.0-150100.3.28.1 |
opensc SUSE:Linux Enterprise Micro 5.2 | All versions | 0.19.0-150100.3.28.1 |
opensc SUSE:Linux Enterprise Micro 5.3 | All versions | 0.22.0-150400.3.9.1 |
opensc SUSE:Linux Enterprise Micro 5.4 | All versions | 0.22.0-150400.3.9.1 |
opensc SUSE:Linux Enterprise Micro 5.5 | All versions | 0.22.0-150400.3.9.1 |
opensc SUSE:Linux Enterprise Micro 5.5 | All versions | 0.22.0-150400.3.9.1 |
opensc SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 0.22.0-150400.3.9.1 |
opensc SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 0.22.0-150600.11.6.1 |
opensc SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 0.22.0-150600.11.6.1 |
opensc SUSE:Linux Enterprise Server 12 SP5 | All versions | 0.13.0-3.28.1 |
opensc SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 0.13.0-3.28.1 |
opensc SUSE:Linux Micro 6.0 | All versions | 0.24.0-4.1 |
opensc openSUSE:Leap 15.5 | All versions | 0.22.0-150400.3.9.1 |
opensc openSUSE:Leap 15.6 | All versions | 0.22.0-150600.11.6.1 |
opensc openSUSE:Leap Micro 5.3 | All versions | 0.22.0-150400.3.9.1 |
opensc openSUSE:Leap Micro 5.4 | All versions | 0.22.0-150400.3.9.1 |
Products include Opensc Project Opensc, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux for Arm 64, Redhat Enterprise Linux for Arm 64 Eus, Redhat Enterprise Linux for Ibm Z Systems and 5 more.
How do I fix CVE-2023-5992?
Apply the vendor's patch.
Is CVE-2023-5992 being exploited?
There is no known exploitation of CVE-2023-5992 in the wild and no public exploit code.
Other vulnerabilities in Opensc Project Opensc
Sources
Also known as ALSA-2024:0966, ALSA-2024:0967, AZL-34088, AZL-35077, BELL-CVE-2023-5992, DEBIAN-CVE-2023-5992 and 14 more.