CVE catalog

CVE-2024-1454

opensc: CVE-2024-1454

Severity: Medium · CVSS 4.5CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Published: Feb 12, 2024, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.42% · Oct 25, 2026

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	opensc	sid	`0.27.1-3`	fixed
Debian	opensc	forky	`0.27.1-3`	fixed
Debian	opensc	trixie	`0.26.1-2`	fixed
Debian	opensc	bookworm	`0.23.0-0.3+deb12u2`	fixed
Opensuse	opensc	tumbleweed	`0.24.0-2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	opensc	source	sid	`0.25.0~rc1-1`	not yet assigned	Not reported	Not reported
Debian	opensc	source	forky	`0.25.0~rc1-1`	not yet assigned	Not reported	Not reported
Debian	opensc	source	trixie	`0.25.0~rc1-1`	not yet assigned	Not reported	Not reported
Debian	opensc	source	bookworm	`0.23.0-0.3+deb12u2`	not yet assigned	Not reported	Not reported
Opensuse	opensc	rpm	tumbleweed	`0.24.0-2.1`	Not reported	OPENSUSE-SU-2024:13733-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]