Is CVE-2023-5992 being actively exploited?

CVE-2023-5992 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2023-5992?

CVE-2023-5992 has a CVSS 3.1 base score of 5.6 (MEDIUM).

CVE-2023-5992

MEDIUM · CVSS 5.6EPSS 1.2%EU EUVD

A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.

Key facts

CVSS score: 5.6 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE): CWE-203
EPSS score: 1.2% (66th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2023-58259)
Published: January 31, 2024
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2023-58259 in the EU Vulnerability Database. Last updated in EUVD on November 6, 2025.

View on the EU Vulnerability Database

Affected products

opensc project / opensc
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux eus
redhat / enterprise linux for arm 64
redhat / enterprise linux for arm 64
redhat / enterprise linux for arm 64 eus
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for power little endian
redhat / enterprise linux for power little endian eus
redhat / enterprise linux server aus
redhat / enterprise linux server for power little endian update services for sap solutions
redhat / enterprise linux server for power little endian update services for sap solutions

Certified products that may be affected

32 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active

See all 32 in the Security Certifications Explorer.

References

https://access.redhat.com/errata/RHSA-2024:0966(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2024:0967(Third Party Advisory)
https://access.redhat.com/security/cve/CVE-2023-5992(Third Party Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=2248685(Issue Tracking)
https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992(Vendor Advisory)
https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/
https://www.usenix.org/system/files/usenixsecurity24-shagam.pdf(Exploit, Technical Description)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain