CVE-2021-43399

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-43399
The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the length of some operations including SSH signing requests, and some data operations received from a YubiHSM 2 device.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.8 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References
Link Resource
https://blog.inhq.net/posts/yubico-yubihsm-shell-vuln3/ Exploit Third Party Advisory
https://www.yubico.com/support/security-advisories/ysa-2021-04/ Vendor Advisory
https://blog.inhq.net/posts/yubico-yubihsm-shell-vuln3/ Exploit Third Party Advisory
https://www.yubico.com/support/security-advisories/ysa-2021-04/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:yubico:yubihsm_2_software_development_kit:*:*:*:*:*:*:*:*
History

21 Nov 2024, 06:29

Type Values Removed Values Added
References () https://blog.inhq.net/posts/yubico-yubihsm-shell-vuln3/ - Exploit, Third Party Advisory () https://blog.inhq.net/posts/yubico-yubihsm-shell-vuln3/ - Exploit, Third Party Advisory
References () https://www.yubico.com/support/security-advisories/ysa-2021-04/ - Vendor Advisory () https://www.yubico.com/support/security-advisories/ysa-2021-04/ - Vendor Advisory

04 Apr 2022, 14:04

Type Values Removed Values Added
References (MISC) https://blog.inhq.net/posts/yubico-yubihsm-shell-vuln3/ - (MISC) https://blog.inhq.net/posts/yubico-yubihsm-shell-vuln3/ - Exploit, Third Party Advisory

25 Feb 2022, 19:15

Type Values Removed Values Added
References
  • (MISC) https://blog.inhq.net/posts/yubico-yubihsm-shell-vuln3/ -

13 Dec 2021, 16:59

Type Values Removed Values Added
References (MISC) https://www.yubico.com/support/security-advisories/ysa-2021-04/ - (MISC) https://www.yubico.com/support/security-advisories/ysa-2021-04/ - Vendor Advisory
CPE cpe:2.3:a:yubico:yubihsm_2_software_development_kit:*:*:*:*:*:*:*:*
CWE CWE-787
CVSS v2 : unknown
v3 : unknown 		v2 : 7.8
v3 : 7.5

08 Dec 2021, 19:26

Type Values Removed Values Added
New CVE
Information

Published : 2021-12-08 19:15

Updated : 2024-11-21 06:29

NVD link : CVE-2021-43399

Mitre link : CVE-2021-43399

CVE.ORG link : CVE-2021-43399

JSON object : View

Products Affected

yubico

  • yubihsm_2_software_development_kit
CWE
CWE-787

Out-of-bounds Write