Detections
Analytics

Alpine: multiple opensc packages: security update to 0.19.0-r3 (deprecated)

medium Tenable Self-Hosted Container Security Plugin ID 400447

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in
 libopensc/asn1.c. (CVE-2019-15946)

 - sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from
 eidenv. (CVE-2019-6502)

 - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in
 libopensc/asn1.c. (CVE-2019-15945)

 - An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c
 has an incorrect read operation during parsing of a SETCOS file attribute. (CVE-2019-19479)

See Also

https://git.alpinelinux.org/aports/commit/?id=1a7ae75cb9ed94f62f9859f8a07a0bc1c5021604

https://git.alpinelinux.org/aports/commit/?id=dae98cd340ff7dc76ebb8d7cf1b949c488688a77

Plugin Details

Severity: Medium

ID: 400447

Version: Revision 1.23

Type: Local

Published: 8/16/2023

Updated: 1/17/2024

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-15946

CVSS v3

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5.8

Vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/31/2019

Vulnerability Publication Date: 1/22/2019

Reference Information

CVE: CVE-2019-15945, CVE-2019-15946, CVE-2019-19479, CVE-2019-19480, CVE-2019-19481, CVE-2019-6502