漏洞标题
N/A
漏洞描述信息
在Yubico库libykpiv的2.1.0之前发现了一个问题。该库(包括Yubico-piv-tool)在设备通信期间未正确检查嵌入长度字段。恶意PIV令牌可能在RSA密钥生成期间错误报告返回的长度字段。这将导致栈内存被复制到返回给调用者的堆内存中。泄露的内存可能包括PINs、密码、密钥材料和其他取决于集成的敏感信息。在调用者进一步处理过程中，这些信息可能会泄露越过信任边界。请注意，RSA密钥生成是由主机触发的，而令牌无法直接触发。
CVSS信息
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-tool) does not properly check embedded length fields during device communication. A malicious PIV token can misreport the returned length fields during RSA key generation. This will cause stack memory to be copied into heap allocated memory that gets returned to the caller. The leaked memory could include PINs, passwords, key material, and other sensitive information depending on the integration. During further processing by the caller, this information could leak across trust boundaries. Note that RSA key generation is triggered by the host and cannot directly be triggered by the token.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Yubico libykpiv 缓冲区错误漏洞
漏洞描述信息
Yubico libykpiv是瑞典Yubico公司的一款YubiKey智能卡微型驱动程序中的秘钥处理库。 Yubico libykpiv 2.1.0之前版本中的lib/util.c文件存在安全漏洞。攻击者可利用该漏洞获取信息。
CVSS信息
N/A
漏洞类别
缓冲区错误