Every CVE Search/ Get API key

CVE-2023-4535

Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

4.5 MediumFix available

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.49%Up 0.4 points since Nov 7, 2023
90%50%10%1%

What each source reports

CVE List Score used 4.5

Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Record
CVE-2023-4535
CVSS 3.1
4.5 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-125
Updated
2026-11-07
EUVDEUVD-2023-54390 4.5

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Record
EUVD-2023-54390
CVSS 3.1
4.5 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Updated
2026-11-07
GitHub AdvisoriesGHSA-phh2-j3h6-vqr9 4.5

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when...

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Record
GHSA-phh2-j3h6-vqr9
CVSS 3.1
4.5 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-125
Updated
2026-11-02
NVD 4.5

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Record
CVE-2023-4535
CVSS 3.1
4.5 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS 3.1
3.8 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-125
Updated
2026-11-07
OSVALPINE-CVE-2023-4535 3.8

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Record
ALPINE-CVE-2023-4535
CVSS 3.1
3.8 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-03
OSVAZL-31945 3.8

CVE-2023-4535 affecting package opensc for versions less than 0.23.0-2

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Record
AZL-31945
CVSS 3.1
3.8 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 6 moreShow less
OSVAZL-35076 3.8

CVE-2023-4535 affecting package opensc for versions less than 0.25.1-3

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Record
AZL-35076
CVSS 3.1
3.8 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSV 4.5

Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Record
CVE-2023-4535
CVSS 3.1
4.5 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2023-4535 3.8

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Record
DEBIAN-CVE-2023-4535
CVSS 3.1
3.8 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-07
OSVRHSA-2023:7879 6.6

Red Hat Security Advisory: opensc security update

Record
RHSA-2023:7879
CVSS 3.1
6.6 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2023:7879 No score

Moderate: opensc security update

The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures.

Security Fix(es):

  • OpenSC: Potential PIN bypass when card tracks its own login state (CVE-2023-40660)
  • OpenSC: multiple memory issues with pkcs15-init (enrollment tool) (CVE-2023-40661)
  • OpenSC: out-of-bounds read in MyEID driver handling encryption using symmetric keys (CVE-2023-4535)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:7879
Updated
2026-11-02
OSVopenSUSE-SU-2024:13314-1 No score

opensc-0.23.0-3.1 on GA media

These are all security issues fixed in the opensc-0.23.0-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13314-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
opensc
Alpine:v3.19
 before 0.24.0-r0
0.24.0-r0
opensc
Alpine:v3.20
 before 0.24.0-r0
0.24.0-r0
opensc
Alpine:v3.21
 before 0.24.0-r0
0.24.0-r0
opensc
Alpine:v3.22
 before 0.24.0-r0
0.24.0-r0
opensc
Alpine:v3.23
 before 0.24.0-r0
0.24.0-r0
opensc
Alpine:v3.24
 before 0.24.0-r0
0.24.0-r0
opensc
AlmaLinux:9
From an advisory covering 3 CVEs
 before 0.23.0-3.el9_3
0.23.0-3.el9_3
opensc
Azure Linux:2
 before 0.23.0-2
0.23.0-2
opensc
Azure Linux:3
 before 0.25.1-3
0.25.1-3
opensc
Debian:12
 before 0.23.0-0.3+deb12u1, plus listed versions
0.23.0-0.3
0.23.0-0.3+deb12u1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
opensc
Debian:13
 before 0.23.0-2
0.23.0-2
opensc
Debian:14
 before 0.23.0-2
0.23.0-2
opensc
Red Hat:enterprise_linux:9::baseos
From an advisory covering 3 CVEs
 before 0:0.23.0-3.el9_3
0:0.23.0-3.el9_3
opensc-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 3 CVEs
 before 0:0.23.0-3.el9_3
0:0.23.0-3.el9_3
opensc-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 3 CVEs
 before 0:0.23.0-3.el9_3
0:0.23.0-3.el9_3
opensc
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 0.23.0-3.1
0.23.0-3.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-4535 is a medium vulnerability (CVSS 4.5) in Opensc Project Opensc, published November 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in opensc 0.24.0-r0.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open