title: Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys
description: An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.
problem types: Out-of-bounds Read
affected:
{
product: OpenSC
vendor: n/a
versions:
version: 0.24.0-rc1, status: unaffected
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: opensc
defaultStatus: affected
versions:
version: 0:0.23.0-3.el9_3, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/o:redhat:enterprise_linux:9::baseos
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: opensc
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:7
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: opensc
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:8
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: opensc
defaultStatus: affected
}
metrics:
other: [
content: {'value': 'Low', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]