Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-2977 Details

Description

A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.1 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CNA: CISA-ADPCVSS-B:7.1 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://access.redhat.com/security/cve/CVE-2023-2977	CVE	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2211088	CVE	Issue TrackingThird Party Advisory
https://github.com/OpenSC/OpenSC/issues/2785	CVE	Issue TrackingPatch
https://github.com/OpenSC/OpenSC/pull/2787	CVE	Patch
https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html	CVE
https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html	CVE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJD4Q4AJSGE5UIJI7OUYZY4HGGCVYQNI/	CVE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAR54OV6EHA56B4XJF6RNPQ4HJ2ITU66/	CVE
https://access.redhat.com/security/cve/CVE-2023-2977	[email protected]	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2211088	[email protected]	Issue TrackingThird Party Advisory
https://github.com/OpenSC/OpenSC/issues/2785	[email protected]	Issue TrackingPatch
https://github.com/OpenSC/OpenSC/pull/2787	[email protected]	Patch
https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html	[email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJD4Q4AJSGE5UIJI7OUYZY4HGGCVYQNI/	[email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAR54OV6EHA56B4XJF6RNPQ4HJ2ITU66/	[email protected]

see all 15 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-125	Out-of-bounds Read	[email protected]
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer	[email protected]

Affected Products

Product	Versions
opensc project opensc	0.23.0 -
CPE cpe:2.3:a:opensc_project:opensc:0.23.0:-:::::: Remediation No remediation found in references.
redhat enterprise linux	8.0 9.0
CPE cpe:2.3:o:redhat:enterprise_linux:8.0:::::::* cpe:2.3:o:redhat:enterprise_linux:9.0:::::::* Remediation No remediation found in references.

Change History

10 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
Nov 3, 2025	CVE Modified	CVE
Jan 9, 2025	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Aug 17, 2023	CVE Modified	[email protected]
Jun 21, 2023	CVE Modified	[email protected]
Jun 7, 2023	Initial Analysis	[email protected]