CVE-2023-5992

MediumCVSS 5.9/10Last modified Nov 5, 2026

Description

A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-203

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 7	—

References

https://access.redhat.com/errata/RHSA-2024:0966Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0967Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-5992Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2248685Issue Tracking
https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992Vendor Advisory
https://www.usenix.org/system/files/usenixsecurity24-shagam.pdfExploit, Technical Description
https://access.redhat.com/errata/RHSA-2024:0966Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0967Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-5992Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2248685Issue Tracking
https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/

Timeline

Published: Jan 31, 2024
Last modified: Nov 5, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-59937.8A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their pr CVE-2023-59957.5An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16 CVE-2023-59968.8Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2023-59978.8Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corrupti CVE-2023-59987.5Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV.CVE-2023-60006.1The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript CVE-2023-60017.5Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere envir CVE-2023-60026.1YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivile CVE-2023-60044.8A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. T CVE-2023-60054.8The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which co CVE-2023-60066.7This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have CVE-2023-60076.5The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capabilit