CVE-2024-1454

opensc project opensc, fedoraproject fedora, redhat enterprise linux

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-1454

Katalog CVE

CVSS 3.4 · Low EPSS 0,42%

Kerentanan Use After Free pada opensc project opensc, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 3.4 (Low) menurut NVD.

Deskripsi (NVD)

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Rincian

Terbit di NVD
12 Februari 2024
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
3.4 (Low), sumber NVD
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-416: Use After Free
EPSS (30 hari)
0,42% peluang dieksploitasi; lebih tinggi dari 34,7% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
opensc project opensc Semua versi sebelum 0.25.0
fedoraproject fedora Versi 38
fedoraproject fedora Versi 39
fedoraproject fedora Versi 40
redhat enterprise linux Versi 7.0
redhat enterprise linux Versi 8.0
redhat enterprise linux Versi 9.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.