CVE-2023-40660

2023-11-0617:15:11

Google

osv.dev

opensc

pin bypass

cryptographic operations

security risk

unauthorized access

malicious actions

compromise

system

cve-2023-40660

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.8%

JSON

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user’s awareness.

CPENameOperatorVersion
opensceq0.18.0-rc1
opensceq0.13.0pre1
opensceq0.22.0-rc1
opensceq0.23.0-rc1
opensceq0.16.0-pre1
opensceq0.23.0-rc2
opensceq0.16.0-rc1
opensceq0.15.0
opensceq0.12.2
opensceq0.20.0-rc1

Name	Operator	Version
opensc	eq	0.18.0-rc1
opensc	eq	0.13.0pre1
opensc	eq	0.22.0-rc1
opensc	eq	0.23.0-rc1
opensc	eq	0.16.0-pre1
opensc	eq	0.23.0-rc2
opensc	eq	0.16.0-rc1
opensc	eq	0.15.0
opensc	eq	0.12.2
opensc	eq	0.20.0-rc1