CVE-2023-40660

Name
CVE-2023-40660
Description
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1
MISC https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories
MISC https://bugzilla.redhat.com/show_bug.cgi?id=2240912
MISC https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651
MISC https://access.redhat.com/security/cve/CVE-2023-40660

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:* opensc >= None <= 0.23.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
opensc edge-community 0.23.0-r0 Timo Teräs <timo.teras@iki.fi> possibly vulnerable
opensc 3.18-community 0.23.0-r0 Timo Teräs <timo.teras@iki.fi> possibly vulnerable
opensc 3.19-community 0.23.0-r0 Timo Teräs <timo.teras@iki.fi> possibly vulnerable