CVE-2023-5992 - Vulnerability Details

Vendors	Products
Opensc Project	Opensc
Redhat	Enterprise Linux Enterprise Linux Eus Enterprise Linux For Arm 64 Enterprise Linux For Arm 64 Eus Enterprise Linux For Ibm Z Systems Enterprise Linux For Ibm Z Systems Eus Enterprise Linux For Power Little Endian Enterprise Linux For Power Little Endian Eus Enterprise Linux Server Aus Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
opensc-0:0.20.0-8.el8_9	cpe:/o:redhat:enterprise_linux:8	RHSA-2024:0967	2024-02-26T00:00:00Z
Red Hat Enterprise Linux 9
opensc-0:0.23.0-4.el9_3	cpe:/o:redhat:enterprise_linux:9	RHSA-2024:0966	2024-02-26T00:00:00Z

Link	Providers
https://access.redhat.com/errata/RHSA-2024:0966
https://access.redhat.com/errata/RHSA-2024:0967
https://access.redhat.com/security/cve/CVE-2023-5992
https://bugzilla.redhat.com/show_bug.cgi?id=2248685
https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/
https://nvd.nist.gov/vuln/detail/CVE-2023-5992
https://www.cve.org/CVERecord?id=CVE-2023-5992
https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
First Time appeared		Redhat enterprise Linux Eus Redhat enterprise Linux For Arm 64 Redhat enterprise Linux For Arm 64 Eus Redhat enterprise Linux For Ibm Z Systems Redhat enterprise Linux For Ibm Z Systems Eus Redhat enterprise Linux For Power Little Endian Redhat enterprise Linux For Power Little Endian Eus Redhat enterprise Linux Server Aus Redhat enterprise Linux Server For Power Little Endian Update Services For Sap Solutions
CPEs		cpe:2.3:o:redhat:enterprise_linux_eus:9.4:::::::* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:::::::* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:::::::* cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:::::::* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:::::::* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:::::::* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:::::::* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:::::::* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:::::::* cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:::::::* cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2:::::::* cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le:::::::*
Vendors & Products		Redhat enterprise Linux Eus Redhat enterprise Linux For Arm 64 Redhat enterprise Linux For Arm 64 Eus Redhat enterprise Linux For Ibm Z Systems Redhat enterprise Linux For Ibm Z Systems Eus Redhat enterprise Linux For Power Little Endian Redhat enterprise Linux For Power Little Endian Eus Redhat enterprise Linux Server Aus Redhat enterprise Linux Server For Power Little Endian Update Services For Sap Solutions

Type	Values Removed	Values Added
References		https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5992", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2023-11-07T15:57:24.037Z", "datePublished": "2024-01-31T14:05:07.630Z", "dateUpdated": "2024-11-24T12:46:52.557Z"}, "containers": {"cna": {"title": "Opensc: side-channel leaks while stripping encryption pkcs#1 padding", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "opensc", "defaultStatus": "affected", "versions": [{"version": "0:0.20.0-8.el8_9", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "opensc", "defaultStatus": "affected", "versions": [{"version": "0:0.23.0-4.el9_3", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "opensc", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:7"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:0966", "name": "RHSA-2024:0966", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:0967", "name": "RHSA-2024:0967", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2023-5992", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248685", "name": "RHBZ#2248685", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992"}, {"url": "https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf"}], "datePublic": "2023-11-28T00:00:00+00:00", "problemTypes": [{"descriptions": [{"cweId": "CWE-203", "description": "Observable Discrepancy", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-203: Observable Discrepancy", "timeline": [{"lang": "en", "time": "2023-11-08T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2023-11-28T00:00:00+00:00", "value": "Made public."}], "credits": [{"lang": "en", "value": "This issue was discovered by Hubert Kario (Red Hat)."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-11-24T12:46:52.557Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5992", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-02T13:54:54.249985Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:28:33.779Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:14:25.164Z"}, "title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:0966", "name": "RHSA-2024:0966", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:0967", "name": "RHSA-2024:0967", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2023-5992", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248685", "name": "RHBZ#2248685", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-5992 (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

state : PUBLISHED (string)

assignerShortName : redhat (string)

dateReserved : 2023-11-07T15:57:24.037Z (string)

datePublished : 2024-01-31T14:05:07.630Z (string)

dateUpdated : 2024-11-24T12:46:52.557Z (string)

}

containers : { »

cna : { »

title : Opensc: side-channel leaks while stripping encryption pkcs#1 padding (string)

metrics : [ »

0 : { »

other : { »

content : { »

value : Moderate (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

type : Red Hat severity rating (string)

}

1 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 5.6 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data. (string)

}

]

affected : [ »

0 : { »

vendor : Red Hat (string)

product : Red Hat Enterprise Linux 8 (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

packageName : opensc (string)

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0:0.20.0-8.el8_9 (string)

lessThan : * (string)

versionType : rpm (string)

status : unaffected (string)

}

]

cpes : [ »

0 : cpe:/o:redhat:enterprise_linux:8::baseos (string)

]

}

1 : { »

vendor : Red Hat (string)

product : Red Hat Enterprise Linux 9 (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

packageName : opensc (string)

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0:0.23.0-4.el9_3 (string)

lessThan : * (string)

versionType : rpm (string)

status : unaffected (string)

}

]

cpes : [ »

0 : cpe:/o:redhat:enterprise_linux:9::baseos (string)

]

}

2 : { »

vendor : Red Hat (string)

product : Red Hat Enterprise Linux 7 (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

packageName : opensc (string)

defaultStatus : affected (string)

cpes : [ »

0 : cpe:/o:redhat:enterprise_linux:7 (string)

]

}

]

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:0966 (string)

name : RHSA-2024:0966 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

1 : { »

url : https://access.redhat.com/errata/RHSA-2024:0967 (string)

name : RHSA-2024:0967 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

2 : { »

url : https://access.redhat.com/security/cve/CVE-2023-5992 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

]

}

3 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2248685 (string)

name : RHBZ#2248685 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

4 : { »

url : https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992 (string)

}

5 : { »

url : https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf (string)

}

]

datePublic : 2023-11-28T00:00:00+00:00 (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-203 (string)

description : Observable Discrepancy (string)

lang : en (string)

type : CWE (string)

}

]

}

]

x_redhatCweChain : CWE-203: Observable Discrepancy (string)

timeline : [ »

0 : { »

lang : en (string)

time : 2023-11-08T00:00:00+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2023-11-28T00:00:00+00:00 (string)

value : Made public. (string)

}

]

credits : [ »

0 : { »

lang : en (string)

value : This issue was discovered by Hubert Kario (Red Hat). (string)

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2024-11-24T12:46:52.557Z (string)

}

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-5992 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-05-02T13:54:54.249985Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-06-04T17:28:33.779Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T08:14:25.164Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:0966 (string)

name : RHSA-2024:0966 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://access.redhat.com/errata/RHSA-2024:0967 (string)

name : RHSA-2024:0967 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

2 : { »

url : https://access.redhat.com/security/cve/CVE-2023-5992 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2248685 (string)

name : RHBZ#2248685 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

4 : { »

url : https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992 (string)

tags : [ »

0 : x_transferred (string)

]

}

5 : { »

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ (string)

tags : [ »

0 : x_transferred (string)

]

}

6 : { »

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ (string)

tags : [ »

0 : x_transferred (string)

]

}

7 : { »

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:0966", "name": "RHSA-2024:0966", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:0967", "name": "RHSA-2024:0967", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2023-5992", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248685", "name": "RHBZ#2248685", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:14:25.164Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5992", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-02T13:54:54.249985Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-02T13:55:02.560Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Opensc: side-channel leaks while stripping encryption pkcs#1 padding", "credits": [{"lang": "en", "value": "This issue was discovered by Hubert Kario (Red Hat)."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:0.20.0-8.el8_9", "lessThan": "*", "versionType": "rpm"}], "packageName": "opensc", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:0.23.0-4.el9_3", "lessThan": "*", "versionType": "rpm"}], "packageName": "opensc", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "opensc", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2023-11-08T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2023-11-28T00:00:00+00:00", "value": "Made public."}], "datePublic": "2023-11-28T00:00:00+00:00", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:0966", "name": "RHSA-2024:0966", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:0967", "name": "RHSA-2024:0967", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2023-5992", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248685", "name": "RHBZ#2248685", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992"}, {"url": "https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf"}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-203", "description": "Observable Discrepancy"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-11-24T12:46:52.557Z"}, "x_redhatCweChain": "CWE-203: Observable Discrepancy"}}, "cveMetadata": {"cveId": "CVE-2023-5992", "state": "PUBLISHED", "dateUpdated": "2024-11-24T12:46:52.557Z", "dateReserved": "2023-11-07T15:57:24.037Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2024-01-31T14:05:07.630Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:0966 (string)

name : RHSA-2024:0966 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://access.redhat.com/errata/RHSA-2024:0967 (string)

name : RHSA-2024:0967 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

2 : { »

url : https://access.redhat.com/security/cve/CVE-2023-5992 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2248685 (string)

name : RHBZ#2248685 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

4 : { »

url : https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992 (string)

tags : [ »

0 : x_transferred (string)

]

}

5 : { »

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ (string)

tags : [ »

0 : x_transferred (string)

]

}

6 : { »

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ (string)

tags : [ »

0 : x_transferred (string)

]

}

7 : { »

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T08:14:25.164Z (string)

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-5992 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-05-02T13:54:54.249985Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-05-02T13:55:02.560Z (string)

}

title : CISA ADP Vulnrichment (string)

}

]

cna : { »

title : Opensc: side-channel leaks while stripping encryption pkcs#1 padding (string)

credits : [ »

0 : { »

lang : en (string)

value : This issue was discovered by Hubert Kario (Red Hat). (string)

}

]

metrics : [ »

0 : { »

other : { »

type : Red Hat severity rating (string)

content : { »

value : Moderate (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

1 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.6 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : LOW (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:/o:redhat:enterprise_linux:8::baseos (string)

]

vendor : Red Hat (string)

product : Red Hat Enterprise Linux 8 (string)

versions : [ »

0 : { »

status : unaffected (string)

version : 0:0.20.0-8.el8_9 (string)

lessThan : * (string)

versionType : rpm (string)

}

]

packageName : opensc (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

defaultStatus : affected (string)

}

1 : { »

cpes : [ »

0 : cpe:/o:redhat:enterprise_linux:9::baseos (string)

]

vendor : Red Hat (string)

product : Red Hat Enterprise Linux 9 (string)

versions : [ »

0 : { »

status : unaffected (string)

version : 0:0.23.0-4.el9_3 (string)

lessThan : * (string)

versionType : rpm (string)

}

]

packageName : opensc (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

defaultStatus : affected (string)

}

2 : { »

cpes : [ »

0 : cpe:/o:redhat:enterprise_linux:7 (string)

]

vendor : Red Hat (string)

product : Red Hat Enterprise Linux 7 (string)

packageName : opensc (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

defaultStatus : affected (string)

}

]

timeline : [ »

0 : { »

lang : en (string)

time : 2023-11-08T00:00:00+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2023-11-28T00:00:00+00:00 (string)

value : Made public. (string)

}

]

datePublic : 2023-11-28T00:00:00+00:00 (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:0966 (string)

name : RHSA-2024:0966 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

1 : { »

url : https://access.redhat.com/errata/RHSA-2024:0967 (string)

name : RHSA-2024:0967 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

2 : { »

url : https://access.redhat.com/security/cve/CVE-2023-5992 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

]

}

3 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2248685 (string)

name : RHBZ#2248685 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

4 : { »

url : https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992 (string)

}

5 : { »

url : https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-203 (string)

description : Observable Discrepancy (string)

}

]

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2024-11-24T12:46:52.557Z (string)

}

x_redhatCweChain : CWE-203: Observable Discrepancy (string)

}

cveMetadata : { »

cveId : CVE-2023-5992 (string)

state : PUBLISHED (string)

dateUpdated : 2024-11-24T12:46:52.557Z (string)

dateReserved : 2023-11-07T15:57:24.037Z (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

datePublished : 2024-01-31T14:05:07.630Z (string)

assignerShortName : redhat (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*", "matchCriteriaId": "835E7B28-6A13-42E4-A819-39920F9970B5", "versionEndExcluding": "0.25.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*", "matchCriteriaId": "B03506D7-0FCD-47B7-90F6-DDEEB5C5A733", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*", "matchCriteriaId": "5A47EF78-A5B6-4B89-8B74-EEB0647C549F", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*", "matchCriteriaId": "2F7DAD7C-9369-4A87-A1D0-4208D3AF0CDC", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*", "matchCriteriaId": "01363FFA-F7A6-43FC-8D47-E67F95410095", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*", "matchCriteriaId": "32AF225E-94C0-4D07-900C-DD868C05F554", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*", "matchCriteriaId": "FB056B47-1F45-4CE4-81F6-872F66C24C29", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*", "matchCriteriaId": "F843B777-5C64-4CAE-80D6-89DC2C9515B1", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*", "matchCriteriaId": "E07C1C58-0E5F-4B56-9B8D-5DE67DB00F79", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*", "matchCriteriaId": "FC3CBA5D-9E5D-4C46-B37E-7BB35BE8DADB", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*", "matchCriteriaId": "39D345D3-108A-4551-A112-5EE51991411A", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*", "matchCriteriaId": "FE4AEBCB-B1E6-4A6A-9E8C-DDC5A003BCB9", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le:*:*:*:*:*:*:*", "matchCriteriaId": "3C30F155-DF7D-4195-92D9-A5B80407228D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en OpenSC donde la eliminaci\u00f3n del relleno de cifrado PKCS#1 no se implementa como resistente al canal lateral. Este problema puede resultar en una posible filtraci\u00f3n de datos privados."}], "id": "CVE-2023-5992", "lastModified": "2024-11-21T08:42:56.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.4, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-31T14:15:48.147", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2024:0966"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2024:0967"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2023-5992"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248685"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Technical Description"], "url": "https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2024:0966"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2024:0967"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2023-5992"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248685"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-203"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-203"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 835E7B28-6A13-42E4-A819-39920F9970B5 (string)

versionEndExcluding : 0.25.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 142AD0DD-4CF3-4D74-9442-459CE3347E3A (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* (string)

matchCriteriaId : F4CFF558-3C47-480D-A2F0-BABF26042943 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 7F6FB57C-2BC7-487C-96DD-132683AEB35D (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:* (string)

matchCriteriaId : B03506D7-0FCD-47B7-90F6-DDEEB5C5A733 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:* (string)

matchCriteriaId : 5A47EF78-A5B6-4B89-8B74-EEB0647C549F (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* (string)

matchCriteriaId : 2F7DAD7C-9369-4A87-A1D0-4208D3AF0CDC (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:* (string)

matchCriteriaId : 01363FFA-F7A6-43FC-8D47-E67F95410095 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* (string)

matchCriteriaId : 32AF225E-94C0-4D07-900C-DD868C05F554 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* (string)

matchCriteriaId : FB056B47-1F45-4CE4-81F6-872F66C24C29 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:* (string)

matchCriteriaId : F843B777-5C64-4CAE-80D6-89DC2C9515B1 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* (string)

matchCriteriaId : E07C1C58-0E5F-4B56-9B8D-5DE67DB00F79 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:* (string)

matchCriteriaId : FC3CBA5D-9E5D-4C46-B37E-7BB35BE8DADB (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 39D345D3-108A-4551-A112-5EE51991411A (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* (string)

matchCriteriaId : FE4AEBCB-B1E6-4A6A-9E8C-DDC5A003BCB9 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le:*:*:*:*:*:*:* (string)

matchCriteriaId : 3C30F155-DF7D-4195-92D9-A5B80407228D (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data. (string)

}

1 : { »

lang : es (string)

value : Se encontró una vulnerabilidad en OpenSC donde la eliminación del relleno de cifrado PKCS#1 no se implementa como resistente al canal lateral. Este problema puede resultar en una posible filtración de datos privados. (string)

}

]

id : CVE-2023-5992 (string)

lastModified : 2024-11-21T08:42:56.353 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 5.6 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 3.4 (number)

source : secalert@redhat.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-01-31T14:15:48.147 (string)

references : [ »

0 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2024:0966 (string)

}

1 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2024:0967 (string)

}

2 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2023-5992 (string)

}

3 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Issue Tracking (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2248685 (string)

}

4 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992 (string)

}

5 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Exploit (string)

1 : Technical Description (string)

]

url : https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2024:0966 (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2024:0967 (string)

}

8 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2023-5992 (string)

}

9 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2248685 (string)

}

10 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992 (string)

}

11 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ (string)

}

12 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ (string)

}

13 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ (string)

}

]

sourceIdentifier : secalert@redhat.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-203 (string)

}

]

source : secalert@redhat.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-203 (string)

}

]

source : nvd@nist.gov (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"acknowledgement": "This issue was discovered by Hubert Kario (Red Hat).", "affected_release": [{"advisory": "RHSA-2024:0967", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "opensc-0:0.20.0-8.el8_9", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-02-26T00:00:00Z"}, {"advisory": "RHSA-2024:0966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "opensc-0:0.23.0-4.el9_3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-02-26T00:00:00Z"}], "bugzilla": {"description": "OpenSC: Side-channel leaks while stripping encryption PKCS#1 padding", "id": "2248685", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248685"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "verified"}, "cwe": "CWE-203", "details": ["A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.", "A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data."], "name": "CVE-2023-5992", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "opensc", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2023-11-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-5992\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-5992\nhttps://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992\nhttps://www.usenix.org/system/files/usenixsecurity24-shagam.pdf"], "threat_severity": "Moderate"}

{

acknowledgement : This issue was discovered by Hubert Kario (Red Hat). (string)

affected_release : [ »

0 : { »

advisory : RHSA-2024:0967 (string)

cpe : cpe:/o:redhat:enterprise_linux:8 (string)

package : opensc-0:0.20.0-8.el8_9 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2024-02-26T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2024:0966 (string)

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

package : opensc-0:0.23.0-4.el9_3 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2024-02-26T00:00:00Z (string)

}

]

bugzilla : { »

description : OpenSC: Side-channel leaks while stripping encryption PKCS#1 padding (string)

id : 2248685 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2248685 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 5.6 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (string)

status : verified (string)

}

cwe : CWE-203 (string)

details : [ »

0 : A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data. (string)

1 : A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data. (string)

]

name : CVE-2023-5992 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

fix_state : Affected (string)

package_name : opensc (string)

product_name : Red Hat Enterprise Linux 7 (string)

}

]

public_date : 2023-11-28T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2023-5992 https://nvd.nist.gov/vuln/detail/CVE-2023-5992 https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992 https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object