CVE-2023-40661

Name	CVE-2023-40661
Description	Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise key generation, certificate loading, and other card management operations during enrollment.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3668-1
Debian Bugs	1055522

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
opensc (PTS)	jessie, jessie (lts)	0.16.0-3+deb8u3	vulnerable
	stretch (security), stretch (lts), stretch	0.16.0-3+deb9u2	vulnerable
	buster (security), buster, buster (lts)	0.19.0-1+deb10u3	fixed
	bullseye	0.21.0-1	vulnerable
	bookworm	0.23.0-0.3+deb12u1	fixed
	sid, trixie	0.25.1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
opensc	source	jessie	(unfixed)	end-of-life
opensc	source	stretch	(unfixed)	end-of-life
opensc	source	buster	0.19.0-1+deb10u3		DLA-3668-1
opensc	source	bookworm	0.23.0-0.3+deb12u1
opensc	source	(unstable)	0.23.0-2			1055522

Notes

[bullseye] - opensc <no-dsa> (Minor issue)
https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651
https://github.com/OpenSC/OpenSC/wiki/CVE-2023-40661
https://bugzilla.redhat.com/show_bug.cgi?id=2240913#c1