QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2021-32489

Back to search

CVE-2021-32489

Published: May 10, 2021

Modified: Aug 3, 2024

PUBLISHED

CVSS v3.1

4.4

MEDIUM

Description

An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length field of an authenticated message received from the device because response_msg.st.len=8 can be accepted but triggers an integer overflow, which causes CRYPTO_cbc128_decrypt (in OpenSSL) to encounter an undersized buffer and experience a segmentation fault. The yubihsm-shell project is included in the YubiHSM 2 SDK product.

VendorProductVersions

n/a

n/a

affected
n/a

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:H/S:U/UI:N

Attack Complexity

High

Attack Vector

Network

Availability

High

Confidentiality

None

Integrity

None

Privileges Required

High

Scope

Unchanged

User Interaction

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now