DEBIAN-CVE-2024-1454

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2024-1454
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-1454.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2024-1454
Upstream
Published
2024-02-12T23:15:08Z
Modified
2025-09-30T05:18:05.736602Z
Severity
  • 3.4 (Low) CVSS_V3 - CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

References

Affected packages

Debian:11 / opensc

Package

Name
opensc
Purl
pkg:deb/debian/opensc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.21.0-1+deb11u1

Affected versions

0.*

0.21.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / opensc

Package

Name
opensc
Purl
pkg:deb/debian/opensc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.23.0-0.3+deb12u2

Affected versions

0.*

0.23.0-0.3
0.23.0-0.3+deb12u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / opensc

Package

Name
opensc
Purl
pkg:deb/debian/opensc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.25.0~rc1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / opensc

Package

Name
opensc
Purl
pkg:deb/debian/opensc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.25.0~rc1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}