What’s Vulnerable › Vulnerabilities

CVE-2023-5992: Opensc: side-channel leaks while stripping encryption pkcs#1 padding

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-31 · updated 2026-06-17
• Weakness: CWE-203

Description

A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.

Affected products

• OpenSC: before 0.25.0 — fixed in 0.25.0
• Red Hat Enterprise Linux: 7.0, 8.0, 9.0
• RedHat Enterprise Linux Eus: 9.4
• RedHat Enterprise Linux For Arm 64: 8.0_aarch64, 9.0_aarch64
• RedHat Enterprise Linux For Arm 64 Eus: 9.4_aarch64
• RedHat Enterprise Linux For Ibm Z Systems: 8.0_s390x, 9.0_s390x
• RedHat Enterprise Linux For Ibm Z Systems Eus: 9.4_s390x
• RedHat Enterprise Linux For Power Little Endian: 9.0_ppc64le
• RedHat Enterprise Linux For Power Little Endian Eus: 9.4_ppc64le
• RedHat Enterprise Linux Server Aus: 9.4
• RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 9.2, 9.4_ppc64le

How to fix

Upgrade to a fixed version: OpenSC 0.25.0. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:0966
• https://access.redhat.com/errata/RHSA-2024:0967
• https://access.redhat.com/security/cve/CVE-2023-5992
• https://bugzilla.redhat.com/show_bug.cgi?id=2248685
• https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992
• https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf
• https://access.redhat.com/errata/RHSA-2024:0966
• https://access.redhat.com/errata/RHSA-2024:0967
• https://access.redhat.com/security/cve/CVE-2023-5992
• https://bugzilla.redhat.com/show_bug.cgi?id=2248685
• https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992
• https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html

Get alerted when CVE-2023-5992 or the next vulnerability affects your stack