{"id":"USN-7346-3","summary":"opensc vulnerabilities","details":"USN-7346-1 fixed vulnerabilities in OpenSC. The update introduced a\nregression which broke smartcard based authentication. This update fixes\nthe problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that OpenSC did not correctly handle certain memory\n operations, which could lead to a use-after-free vulnerability. An\n attacker could possibly use this issue to cause a denial of service or\n execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\n Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780)\n \n It was discovered that OpenSC did not correctly handle certain memory\n operations, which could lead to a stack buffer overflow. An attacker\n could possibly use this issue to cause a denial of service or execute\n arbitrary code. This issue only affected Ubuntu 20.04 LTS. \n (CVE-2021-42782)\n \n It was discovered that OpenSC did not correctly handle the length of\n certain buffers, which could lead to a out-of-bounds access vulnerability.\n An attacker could possibly use this issue to cause a denial of service or\n execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\n Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977)\n \n Deepanjan Pal discovered that OpenSC did not correctly authenticate a zero\n length PIN. A physically proximate attacker could possibly use this issue\n to gain unauthorized access to certain systems. This issue only affected \n Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660)\n \n It was discovered that OpenSC did not correctly handle certain memory\n operations. A physically proximate attacker could possibly use this issue\n to compromise key generation, certificate loading and other card\n management operations. This issue only affected Ubuntu 20.04 LTS and\n Ubuntu 22.04 LTS. (CVE-2023-40661)\n \n Hubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a\n timing side-channel and incorrectly handled RSA padding. An attacker\n could possibly use this issue to recover sensitive information. This issue\n only affected Ubuntu 22.04 LTS. (CVE-2023-5992)\n \n Matteo Marini discovered that OpenSC did not properly manage memory due to\n certain uninitialized variables. A physically proximate attacker could\n possibly use this issue to gain unauthorized access to certain systems.\n This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\n Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615)\n \n Matteo Marini discovered that OpenSC did not correctly handle certain\n memory operations. A physically proximate attacker could possibly use this\n issue to gain unauthorized access to certain systems. This issue only\n affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\n Ubuntu 24.10. (CVE-2024-45616, CVE-2024-45617)\n \n Matteo Marini discovered that OpenSC did not correctly handle certain\n memory operations. A physically proximate attacker could possibly use this\n issue to gain unauthorized access to certain systems.\n (CVE-2024-45618, CVE-2024-45620)\n \n Matteo Marini discovered that OpenSC did not correctly handle certain\n memory operations. A physically proximate attacker could possibly use this\n issue to gain unauthorized access to certain systems. This issue only\n affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.\n (CVE-2024-45619)\n \n It was discovered that OpenSC did not correctly handle certain memory\n operations, which could lead to a buffer overflow. A physically\n proximate attacker could possibly use this issue to compromise card\n management operations during enrollment and modification. This issue only\n affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\n Ubuntu 24.10. (CVE-2024-8443)\n","modified":"2026-02-10T04:47:18Z","published":"2025-04-09T23:41:04Z","related":["UBUNTU-CVE-2021-42780","UBUNTU-CVE-2021-42782","UBUNTU-CVE-2023-2977","UBUNTU-CVE-2023-40660","UBUNTU-CVE-2023-40661","UBUNTU-CVE-2024-45615","UBUNTU-CVE-2024-45616","UBUNTU-CVE-2024-45617","UBUNTU-CVE-2024-45618","UBUNTU-CVE-2024-45620","UBUNTU-CVE-2024-8443"],"upstream":["CVE-2021-42780","CVE-2021-42782","CVE-2023-2977","CVE-2023-40660","CVE-2023-40661","CVE-2024-45615","CVE-2024-45616","CVE-2024-45617","CVE-2024-45618","CVE-2024-45620","CVE-2024-8443","UBUNTU-CVE-2021-42780","UBUNTU-CVE-2021-42782","UBUNTU-CVE-2023-2977","UBUNTU-CVE-2023-40660","UBUNTU-CVE-2023-40661","UBUNTU-CVE-2024-45615","UBUNTU-CVE-2024-45616","UBUNTU-CVE-2024-45617","UBUNTU-CVE-2024-45618","UBUNTU-CVE-2024-45620","UBUNTU-CVE-2024-8443"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-7346-3"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-42780"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-42782"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-2977"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-40660"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-40661"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-8443"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-45615"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-45616"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-45617"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-45618"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-45620"},{"type":"REPORT","url":"https://launchpad.net/bugs/2104948"}],"affected":[{"package":{"name":"opensc","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/opensc@0.20.0-3ubuntu0.1~esm4?arch=source&distro=esm-apps/focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-3ubuntu0.1~esm4"}]}],"versions":["0.19.0-2","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-3ubuntu0.1~esm1","0.20.0-3ubuntu0.1~esm2","0.20.0-3ubuntu0.1~esm3"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"opensc","binary_version":"0.20.0-3ubuntu0.1~esm4"},{"binary_name":"opensc-pkcs11","binary_version":"0.20.0-3ubuntu0.1~esm4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7346-3.json","cves_map":{"cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2021-42780"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2021-42782"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-2977"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-40660"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-40661"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2024-8443"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2024-45615"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2024-45616"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2024-45617"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2024-45618"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2024-45620"}],"ecosystem":"Ubuntu:Pro:20.04:LTS"}}}],"schema_version":"1.7.3"}