CVE-2023-5992

Exploit

EPSS 1.16%
Veröffentlicht 31.01.2024 14:15:48
Zuletzt bearbeitet 03.11.2025 22:16:32
Erkennungen
Login

Opensc: side-channel leaks while stripping encryption pkcs#1 padding

A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 13

NVD 16 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Opensc Project ≫ Opensc Version < 0.25.0

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Enterprise Linux Version 8.0

Redhat ≫ Enterprise Linux Version 9.0

Redhat ≫ Enterprise Linux Eus Version 9.4

Redhat ≫ Enterprise Linux For Arm 64 Version 8.0_aarch64

Redhat ≫ Enterprise Linux For Arm 64 Version 9.0_aarch64

Redhat ≫ Enterprise Linux For Arm 64 Eus Version 9.4_aarch64

Redhat ≫ Enterprise Linux For Ibm Z Systems Version 8.0_s390x

Redhat ≫ Enterprise Linux For Ibm Z Systems Version 9.0_s390x

Redhat ≫ Enterprise Linux For Ibm Z Systems Eus Version 9.4_s390x

Redhat ≫ Enterprise Linux For Power Little Endian Version 9.0_ppc64le

Redhat ≫ Enterprise Linux For Power Little Endian Eus Version 9.4_ppc64le

Redhat ≫ Enterprise Linux Server Aus Version 9.4

Redhat ≫ Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Version 9.2

Redhat ≫ Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Version 9.4_ppc64le

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.16%	0.629

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.9	2.2	3.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
RedHat	5.6	2.2	3.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

https://access.redhat.com/errata/RHSA-2024:0966

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:0967

Third Party Advisory

https://access.redhat.com/security/cve/CVE-2023-5992

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2248685

Issue Tracking

https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992

Vendor Advisory

https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf

Exploit

Technical Description

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/

https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html

https://nvd.nist.gov/vuln/detail/CVE-2023-5992

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-5992

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-5992

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2023-5992