Improper Input Validation Affecting github.com/yubico/yubihsm-connector package, versions <3.0.1


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.19% (58th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Input Validation vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-GOLANG-GITHUBCOMYUBICOYUBIHSMCONNECTOR-1246475
  • published15 Apr 2021
  • disclosed15 Apr 2021
  • creditUnknown

Introduced: 15 Apr 2021

CVE-2021-28484  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

Upgrade github.com/Yubico/yubihsm-connector to version 3.0.1 or higher.

Overview

github.com/Yubico/yubihsm-connector is a YubiHSM Connector

Affected versions of this package are vulnerable to Improper Input Validation. An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send it data, preventing any further operations until the yubihsm-connector is restarted. An attacker can send 0, 1, or 2 bytes to trigger this.

CVSS Scores

version 3.1