{
  "cveId": "CVE-2023-40660",
  "url": "https://patchblox.com/security/cve/CVE-2023-40660",
  "summary": "CVE-2023-40660 is fixed in 4 products on 1 platform, first by ALAS2023-2023-417, released October 30, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "opensc: The OpenSC set of libraries and utilities provides support for working with smart cards",
  "description": "The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures.\n\nSecurity Fix(es):\n\n* OpenSC: Potential PIN bypass when card tracks its own login state (CVE-2023-40660)\n\n* OpenSC: multiple memory issues with pkcs15-init (enrollment tool) (CVE-2023-40661)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "published": "2023-10-30T23:44:00Z",
  "severity": "Moderate",
  "cvss": 6.6,
  "cvssVector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss": 0.01038,
  "epssPercentile": 0.64183,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "opensc",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "0.23.0-0.3\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2023-40660",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-40660",
      "released": "2023-11-06T17:15:11Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.23.0-2",
      "fix": "DEBIAN-CVE-2023-40660",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-40660",
      "released": "2023-11-06T17:15:11Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "Debian 14",
      "fixedVersion": "0.23.0-2",
      "fix": "DEBIAN-CVE-2023-40660",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-40660",
      "released": "2023-11-06T17:15:11Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "RHEL 8",
      "fixedVersion": "0:0.20.0-7.el8_9",
      "fix": "RHSA-2023:7876",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2023-7876",
      "released": "2023-12-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "RHEL 9",
      "fixedVersion": "0:0.23.0-3.el9_3",
      "fix": "RHSA-2023:7879",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2023-7879",
      "released": "2023-12-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "0.20.0-3ubuntu0.1~esm4",
      "fix": "opensc 0.20.0-3ubuntu0.1~esm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-opensc-0.20.0-3ubuntu0.1-esm4",
      "released": "2024-09-10T07:15:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "0.22.0-1ubuntu2\u002Besm1",
      "fix": "opensc 0.22.0-1ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-opensc-0.22.0-1ubuntu2-esm1",
      "released": "2024-09-10T07:15:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "almalinux 8",
      "fixedVersion": "0.20.0-7.el8_9",
      "fix": "ALSA-2023:7876",
      "url": "https://patchblox.com/security/fix/linux/alsa-2023-7876",
      "released": "2023-12-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "almalinux 9",
      "fixedVersion": "0.23.0-3.el9_3",
      "fix": "ALSA-2023:7879",
      "url": "https://patchblox.com/security/fix/linux/alsa-2023-7879",
      "released": "2023-12-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "amzn 2023",
      "fixedVersion": "0.23.0-3.amzn2023.0.2",
      "fix": "ALAS2023-2023-417",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-417",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "ol 8",
      "fixedVersion": "0:0.20.0-7.el8_9",
      "fix": "ELSA-2023-7876",
      "url": "https://patchblox.com/security/fix/linux/elsa-2023-7876",
      "released": "2023-12-18T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc",
      "release": "ol 9",
      "fixedVersion": "0:0.23.0-3.el9_3",
      "fix": "ELSA-2023-7879",
      "url": "https://patchblox.com/security/fix/linux/elsa-2023-7879",
      "released": "2023-12-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "0.23.0-3.amzn2023.0.2",
      "fix": "ALAS2023-2023-417",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-417",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "0.23.0-3.amzn2023.0.2",
      "fix": "ALAS2023-2023-417",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-417",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc-pkcs11",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "0.20.0-3ubuntu0.1~esm4",
      "fix": "opensc-pkcs11 0.20.0-3ubuntu0.1~esm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-opensc-pkcs11-0.20.0-3ubuntu0.1-esm4",
      "released": "2024-09-10T07:15:00Z"
    },
    {
      "platform": "linux",
      "product": "opensc-pkcs11",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "0.22.0-1ubuntu2\u002Besm1",
      "fix": "opensc-pkcs11 0.22.0-1ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-opensc-pkcs11-0.22.0-1ubuntu2-esm1",
      "released": "2024-09-10T07:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}