A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - opensc: Stack buffer overflow issues in various places (CVE-2021-42782)

  - A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.
    (CVE-2021-42778)

  - A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid. (CVE-2021-42779)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of opensc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-42778 advisory.

  - A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.
    (CVE-2021-42778)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202209-03 (OpenSC: Multiple Vulnerabilities)

  - A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.
    (CVE-2021-42778)

  - A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid. (CVE-2021-42779)

  - A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could     potentially crash programs using the library. (CVE-2021-42780)

  - Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could     potentially crash programs using the library. (CVE-2021-42781)

  - Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could     potentially crash programs using the library. (CVE-2021-42782)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198881	RHEL 8 : opensc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
173000	CBL Mariner 2.0 Security Update: opensc (CVE-2021-42778)	Nessus	MarinerOS Local Security Checks	medium
164803	GLSA-202209-03 : OpenSC: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2021-42778

medium

Tenable Plugins

medium

medium

medium