PT-2021-23830 · Yubico · Yubihsm 2

Christian Reitter · Published 2021-12-08 · Updated 2022-04-04 · CVE-2021-43399

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Yubico YubiHSM YubiHSM2 library version 2021.08

Description The issue arises from improper validation of the length of certain operations, including SSH signing requests and data operations received from a YubiHSM 2 device. This affects the Yubico YubiHSM YubiHSM2 library included in the yubihsm-shell project.

Recommendations For Yubico YubiHSM YubiHSM2 library version 2021.08, consider updating to a newer version that properly validates the length of operations to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-43399

Affected Products

Yubihsm 2

References · 5

• 🔥 https://blog.inhq.net/posts/yubico-yubihsm-shell-vuln3 · Exploit
• https://yubico.com/support/security-advisories/ysa-2021-04 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43399 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43399 · Vendor Advisory
• https://t.me/cibsecurity/33633 · Telegram Post