Base Score

MEDIUM6.8

CVE-2019-20792

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.

VectorPHYSICAL

Published Bycve@mitre.org

Published DateApr 29, 2020, 04:15

Weakness Type (CWE):CWE-415

CVSS Metrics

Base Score

6.8

Vector String

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

PHYSICAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH

References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19208
https://github.com/OpenSC/OpenSC/commit/c246f6f69a749d4f68626b40795a4f69168008f4
https://github.com/OpenSC/OpenSC/compare/0.19.0...0.20.0

Base Score

MEDIUM6.8

Weakness Type (CWE):CWE-415

CVSS Metrics

Base Score

6.8

Vector String

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

PHYSICAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH