CVE-2020-26572

lowPriorität · verfolgen · 22EPSS 0.004 · 32. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (32nd) EPSS

CVSS 2.1 · low

Is it mine?

26 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · bewertet 2026-10-28

The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenopensc-0:0.20.0-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-0:0.20.0-4.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-0:0.20.0-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-0:0.20.0-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-0:0.20.0-4.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-0:0.20.0-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-debuginfo-0:0.20.0-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-debuginfo-0:0.20.0-4.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-debuginfo-0:0.20.0-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-debuginfo-0:0.20.0-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-debuginfo-0:0.20.0-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-debugsource-0:0.20.0-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-debugsource-0:0.20.0-4.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-debugsource-0:0.20.0-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-debugsource-0:0.20.0-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Behobenopensc-debugsource-0:0.20.0-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1600
Workaroundopensc-0:0.20.0-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-0:0.20.0-4.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-0:0.20.0-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-0:0.20.0-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-0:0.20.0-4.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-0:0.20.0-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-debuginfo-0:0.20.0-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-debuginfo-0:0.20.0-4.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-debuginfo-0:0.20.0-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-debuginfo-0:0.20.0-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-debuginfo-0:0.20.0-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-debugsource-0:0.20.0-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-debugsource-0:0.20.0-4.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-debugsource-0:0.20.0-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-debugsource-0:0.20.0-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
Workaroundopensc-debugsource-0:0.20.0-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
This flaw can be mitigated in cases where you can use opensc without the TCOS driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion. One such example: ``` app default { card_drivers = cac, cac1, PIV-II; } ``` This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the TCOS driver. With the TCOS driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.4

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 2.1–6.4

v2.02.1lowAV:L/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 2.9

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 3.6

v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.16.4mediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-787USprimärCWE-787US

betroffene Produkte (26)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Open Source Arch Linuxalle Versionencert_bundDEcpe:/o:archlinux:archlinux:-
Open Source OpenSC 0.19.0alle Versionencert_bundDEcpe:/a:opensc:opensc:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxalle Versionencert_bundDEcpe:/o:suse:suse_linux:-
n/a n/a≤ n/aenisa_euvdEU
debian debian linux= 9.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
fedoraproject fedora= 33nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
opensc project opensc≤ 0.20.0nvdUScpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*
opensc-0:0.20.0-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)alle Versionenfixedredhat_csafUS
opensc-0:0.20.0-4.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)alle Versionenfixedredhat_csafUS
opensc-0:0.20.0-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)alle Versionenfixedredhat_csafUS
opensc-0:0.20.0-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)alle Versionenfixedredhat_csafUS
opensc-0:0.20.0-4.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)alle Versionenfixedredhat_csafUS
opensc-0:0.20.0-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)alle Versionenfixedredhat_csafUS
opensc-debuginfo-0:0.20.0-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)alle Versionenfixedredhat_csafUS
opensc-debuginfo-0:0.20.0-4.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)alle Versionenfixedredhat_csafUS
opensc-debuginfo-0:0.20.0-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)alle Versionenfixedredhat_csafUS
opensc-debuginfo-0:0.20.0-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)alle Versionenfixedredhat_csafUS

20 von 26 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2021:1600Red Hat Security Advisory: opensc security, bug fix, and enhancement update2021-05-18csaf · redhat_csafUS
An update for opensc is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2023-2404OpenSC: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2020-10-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSC ausnutzen, um einen Denial of Service Zustand herbeizuführen oder um beliebigen Programmcode auszuführen.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund nvd redhat_csaf NVD CVE.org MITRE

veröffentlicht 2020-10-06geändert 2026-06-17

verwandt (16,140)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-111497US	—OT kritisch	88.0% (100th)	KEV	2026-10-22
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to co…
CVE-2026-86950US	—OT kritisch	26.2% (98th)	KEV	2026-09-28
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1,…
CVE-2026-87491US	—OT kritisch	3.51% (89th)	KEV	2026-09-09
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security…
CVE-2026-53362US	—OT kritisch	0.71% (53rd)	KEV	2026-07-04
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branc…
CVE-2026-53266US	—OT kritisch	0.93% (61st)	KEV	2026-06-25
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source addre…

+16135 weitere

Referenzen (25)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan