Bug 2016448 (CVE-2021-42782)

Summary:	CVE-2021-42782 opensc: Stack buffer overflow issues in various places
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	chazlett, crypto-team, jjelen, tm
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	opensc 0.22.0	Doc Type:	If docs needed, set a value
Doc Text:	A stack buffer overflow issue was found in the OpenSC package. This flaw can potentially crash programs using the library.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2018908, 2022290
Bug Blocks:	2001773, 2016521, 2235483

Description Pedro Sampaio 2021-10-21 14:34:31 UTC

Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.

Upstream commits:

https://github.com/OpenSC/OpenSC/commit/78cdab94
https://github.com/OpenSC/OpenSC/commit/7114fb71
https://github.com/OpenSC/OpenSC/commit/1252aca9
https://github.com/OpenSC/OpenSC/commit/ae1cf0be
https://github.com/OpenSC/OpenSC/commit/456ac566

References:

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27719
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28855
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29912
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30800
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35766
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36200

Comment 1 msiddiqu 2021-11-01 08:47:03 UTC

Created opensc tracking bugs for this issue:

Affects: fedora-33 [bug 2018908]

Comment 4 Chess Hazlett 2023-09-01 20:10:32 UTC

*** Bug 2235485 has been marked as a duplicate of this bug. ***