The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:4483 advisory.

  - opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c     (CVE-2019-15945)

  - opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c     (CVE-2019-15946)

  - opensc: Incorrect read operation during parsing of a SETCOS file attribute (CVE-2019-19479)

  - opensc: Improper handling of buffer limits for CAC certificates (CVE-2019-19481)

  - opensc: Double free in coolkey_free_private_data in libopensc/card-coolkey.c (CVE-2019-20792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4483 advisory.

    The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on     cards that support cryptographic operations and enables their use for authentication, mail encryption, or     digital signatures.

    The following packages have been upgraded to a later upstream version: opensc (0.20.0). (BZ#1810660)

    Security Fix(es):

    * opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c     (CVE-2019-15945)

    * opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c     (CVE-2019-15946)

    * opensc: Improper handling of buffer limits for CAC certificates (CVE-2019-19481)

    * opensc: Double free in coolkey_free_private_data in libopensc/card-coolkey.c (CVE-2019-20792)

    * opensc: Incorrect read operation during parsing of a SETCOS file attribute (CVE-2019-19479)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the opensc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - OpenSC before 0.20.0-rc1 has an out-of-bounds access of     an ASN.1 Bitstring in decode_bit_string in     libopensc/asn1.c.(CVE-2019-15945)

  - OpenSC before 0.20.0-rc1 has an out-of-bounds access of     an ASN.1 Octet string in asn1_decode_entry in     libopensc/asn1.c.(CVE-2019-15946)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2020:4483 advisory.

  - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in     libopensc/asn1.c. (CVE-2019-15945)

  - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in     libopensc/asn1.c. (CVE-2019-15946)

  - An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c     has an incorrect read operation during parsing of a SETCOS file attribute. (CVE-2019-19479)

  - An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c     mishandles buffer limits for CAC certificates. (CVE-2019-19481)

  - OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in     libopensc/card-coolkey.c lacks a uniqueness check. (CVE-2019-20792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for opensc fixes the following issues :

CVE-2019-15945: Fixed an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string (bsc#1149746).

CVE-2019-15946: Fixed an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry (bsc#1149747)

CVE-2019-19479: Fixed an incorrect read operation during parsing of a SETCOS file attribute (bsc#1158256)

CVE-2019-19480: Fixed an improper free operation in sc_pkcs15_decode_prkdf_entry (bsc#1158307).

CVE-2019-20792: Fixed a double free in coolkey_free_private_data (bsc#1170809).

CVE-2020-26570: Fixed a buffer overflow in sc_oberthur_read_file (bsc#1177364).

CVE-2020-26571: Fixed a stack-based buffer overflow in gemsafe GPK smart card software driver (bsc#1177380)

CVE-2020-26572: Fixed a stack-based buffer overflow in tcos_decipher (bsc#1177378).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1041-1 advisory.

    Security issues fixed:

    - CVE-2021-42780: Fixed use after return in insert_pin() (bsc#1192005).
    - CVE-2021-42779: Fixed use after free in sc_file_valid() (bsc#1191992).
    - CVE-2021-42781: Fixed multiple heap buffer overflows in pkcs15-oberthur.c (bsc#1192000).
    - CVE-2021-42782: Stack buffer overflow issues in various places (bsc#1191957).
    - CVE-2019-6502: Fixed a memory leak in sc_context_create() (bsc#1122756).
    - CVE-2020-26570: Fixed a heap based buffer overflow in sc_oberthur_read_file (bsc#1177364).
    - CVE-2020-26572: Prevent out of bounds write (bsc#1177378)
    - CVE-2020-26571: gemsafe GPK smart card software driver stack-based buffer overflow (bsc#1177380)
    - CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry (bsc#1149747)
    - CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (bsc#1158256)
    - CVE-2019-15945: Fixed an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string (bsc#1149746).
    - CVE-2019-19481: Fixed an improper handling of buffer limits for CAC certificates (bsc#1158305).
    - CVE-2019-20792: Fixed a double free in coolkey_free_private_data (bsc#1170809).

    Non-security issues fixed:

    - Fixes segmentation fault in 'pkcs11-tool.c'. (bsc#1114649)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
145809	CentOS 8 : opensc (CESA-2020:4483)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/25	medium
142399	RHEL 8 : opensc (RHSA-2020:4483)	Nessus	Red Hat Local Security Checks	2020/11/4	2025/3/15	medium
140833	EulerOS 2.0 SP3 : opensc (EulerOS-SA-2020-2066)	Nessus	Huawei Local Security Checks	2020/9/28	2024/2/19	medium
157509	AlmaLinux 8 : opensc (ALSA-2020:4483)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/13	medium
148502	SUSE SLED15 / SLES15 Security Update : opensc (SUSE-SU-2021:1168-1)	Nessus	SuSE Local Security Checks	2021/4/14	2024/1/4	medium
159349	SUSE SLES15 Security Update : opensc (SUSE-SU-2022:1041-1)	Nessus	SuSE Local Security Checks	2022/3/30	2026/6/26	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium