CVE-2020-13131

Katalog CVE

CVSS 4.3 · Medium EPSS 0,49%

Kerentanan Out-of-bounds Read pada yubico libykpiv, yubico piv tool manager +1 lainnya. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-tool) does not properly check embedded length fields during device communication. A malicious PIV token can misreport the returned length fields during RSA key generation. This will cause stack memory to be copied into heap allocated memory that gets returned to the caller. The leaked memory could include PINs, passwords, key material, and other sensitive information depending on the integration. During further processing by the caller, this information could leak across trust boundaries. Note that RSA key generation is triggered by the host and cannot directly be triggered by the token.

Rincian

Terbit di NVD

9 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.yubico.com/products/services-software/download/smart-card-drivers-tools/ advisory vendor
• https://blog.inhq.net/posts/yubico-libykpiv-vuln/ exploit · advisory pihak ketiga