[pkg-opensc-maint] Bug#1055522: opensc: CVE-2023-40661

[Salvatore Bonaccorso]

Source: opensc
Version: 0.23.0-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for opensc.

CVE-2023-40661[0]:
| Several memory vulnerabilities were identified within the OpenSC
| packages, particularly in the card enrollment process using
| pkcs15-init when a user or administrator enrolls cards. To take
| advantage of these flaws, an attacker must have physical access to
| the computer system and employ a custom-crafted USB device or smart
| card to manipulate responses to APDUs. This manipulation can
| potentially allow   compromise key generation, certificate loading,
| and other card management operations during enrollment.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

Note that this CVE covers various of the oss-fuzz related issues
reported since the 0.23.0 release.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-40661
    https://www.cve.org/CVERecord?id=CVE-2023-40661
[1] https://github.com/OpenSC/OpenSC/wiki/CVE-2023-40661

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore