Log in Start free

Vulnerability · Published Jul 9, 2020 · Assigned by mitre

CVE-2020-13131

Medium 4.3

In plain English

A medium-severity security flaw in the yubico-piv-tool package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)4.3Medium
Exploit odds (30 days)0.5%top 57.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-tool) does not properly check embedded length fields during device communication. A malicious PIV token can misreport the returned length fields during RSA key generation. This will cause stack memory to be copied into heap allocated memory that gets returned to the caller. The leaked memory could include PINs, passwords, key material, and other sensitive information depending on the integration. During further processing by the caller, this information could leak across trust boundaries. Note that RSA key generation is triggered by the host and cannot directly be triggered by the token.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12yubico-piv-tool2.1.1-1DEBIAN-CVE-2020-13131
Debian:13yubico-piv-tool2.1.1-1DEBIAN-CVE-2020-13131
Debian:14yubico-piv-tool2.1.1-1DEBIAN-CVE-2020-13131

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References