CVE-2021-43399 - The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the length of some operations including SSH signing requests, and some data operations received from a YubiHSM 2 device

Back Back to CVE browser

HIGH

The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the length of some operations including SSH signing requests, and some data operations received from a YubiHSM 2 device

Published Dec 8, 2021

7.5

HIGH

CVSS 3.1

EPSS 1.41%

Description

The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the length of some operations including SSH signing requests, and some data operations received from a YubiHSM 2 device.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (3)

https://blog.inhq.net/posts/yubico-yubihsm-shell-vuln3/
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-30334
Advisory
https://www.yubico.com/support/security-advisories/ysa-2021-04/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://blog.inhq.net/posts/yubico-yubihsm-shell-vuln3/		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-30334		Advisory
https://www.yubico.com/support/security-advisories/ysa-2021-04/		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 8, 2021

Updated Aug 4, 2024

Reserved Nov 4, 2021

Link CVE-2021-43399

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2021-43399

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Dec 8, 2021

Updated Aug 4, 2024

Link EUVD-2021-30334

GitHub

No data