QwikSec

Security Database

CVE

CWE

Training

CVE-2020-24387

Published: Oct 19, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explicitly check the returned session id from the device. An invalid session id would lead to out-of-bounds read and write operations in the session array. This could be used by an attacker to cause a denial of service attack.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/Yubico/yubihsm-shell

x_refsource_MISC

https://developers.yubico.com/yubihsm-shell/

x_refsource_MISC

https://www.yubico.com/support/security-advisories/ysa-2020-06/

x_refsource_MISC

https://blog.inhq.net/posts/yubico-libyubihsm-vuln/

x_refsource_MISC

FEDORA-2020-8afd443d46

vendor-advisory

x_refsource_FEDORA

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.