CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 1CVE-2020-10185
https://notcve.org/view.php?id=CVE-2020-10185
05 Mar 2020 — The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT affect YubiCloud. El endpoint sync en YubiKey Validation Server versiones anteriores a 2.40, permite a atacantes remotos reproducir una OTP. NOTA: este problema es potencialmente relevante para personas ajenas a Yubi... • https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40 • CWE-294: Authentication Bypass by Capture-replay •
CVSS: 9.8EPSS: 1%CPEs: 5EXPL: 0CVE-2011-4120
https://notcve.org/view.php?id=CVE-2011-4120
26 Nov 2019 — Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the account in question by providing a NULL value (pressing Ctrl-D keyboard sequence) as the password string. El módulo PAM de Yubico versiones anteriores a 2.10, realizó la autenticación del usuario cuando no se util... • https://access.redhat.com/security/cve/cve-2011-4120 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-12210
https://notcve.org/view.php?id=CVE-2019-12210
04 Jun 2019 — In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation. En Yubico pam-u2f 1.0.7, cuando se configura con depuración y se configura un archivo de registro de d... • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-12209
https://notcve.org/view.php?id=CVE-2019-12209
04 Jun 2019 — Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information. Yubico pam-u2f 1.0.7 intenta analizar el archivo de configuración configurado (predeterminado ... • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2019-9578 – Gentoo Linux Security Advisory 202004-15
https://notcve.org/view.php?id=CVE-2019-9578
05 Mar 2019 — In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device. En devs.c en Yubico libu2f-host, en versiones anteriores a la 1.1.8, la respuesta a init se analiza erróneamente, filtrando memoria de pila no inicializada de vuelta al dispositivo. Multiple vulnerabilities have been found in libu2f-host, the worst of which could result in the execution of code. Versions less than 1.1.10 are affected. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html • CWE-908: Use of Uninitialized Resource •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-20340 – Debian Security Advisory 4389-1
https://notcve.org/view.php?id=CVE-2018-20340
12 Feb 2019 — Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey. Yubico libu2f-host 1.1.6 contiene búferes sin comprobar en devs.c, lo que podría permitir que un token malicioso explote un desbor... • https://blog.inhq.net/posts/yubico-libu2f-host-vuln-part1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 10EXPL: 0CVE-2018-14779 – Ubuntu Security Notice USN-4276-1
https://notcve.org/view.php?id=CVE-2018-14779
14 Aug 2018 — A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `ykpiv_transfer_data()`: {% highlight c %} if(*out_len + recv_len - 2 > max_out) { fprintf(stderr, "Output buffer to small, wanted to write %lu, max was %lu.", *out_len + recv_len - 2, max_out); } if(out_data) { memcpy(out_data, data, recv_len - 2); out_data += recv_len - 2; *out_len += recv_len - 2; } {% endhighlight %} -- it is clearly checked whether the buffer... • http://www.openwall.com/lists/oss-security/2018/08/14/2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 4.6EPSS: 0%CPEs: 10EXPL: 0CVE-2018-14780 – Yubico PIV Tool 1.5.0 Buffer Overflow
https://notcve.org/view.php?id=CVE-2018-14780
14 Aug 2018 — An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, &outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved... • http://www.openwall.com/lists/oss-security/2018/08/14/2 • CWE-125: Out-of-bounds Read •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2018-9275
https://notcve.org/view.php?id=CVE-2018-9275
04 Apr 2018 — In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file, which can lead to information disclosure (serial number of a device) and/or DoS (reaching the maximum number of file descriptors). En check_user_token en util.c en el módulo Yubico PAM (también conocido como pam_yubico), de la versión 2.18 hasta la 2.25, los inicios de sesión exitosos pueden filtrar descriptores de archivo al archivo de mapeo auth. ... • https://bugzilla.opensuse.org/show_bug.cgi?id=1088027 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •