CVE-2021-32489 Integer overflow in n/a
An integer overflow in Yubico yubihsm-shell allows a malicious device response to cause a segmentation fault, resulting in denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32489?
CVE-2021-32489 is a medium-severity vulnerability in n/a, published on 10 May 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length field of an authenticated message received from the device because response_msg.st.len=8 can be accepted but triggers an integer overflow, which causes CRYPTO_cbc128_decrypt (in OpenSSL) to encounter an undersized buffer and experience a segmentation fault. The yubihsm-shell project is included in the YubiHSM 2 SDK product.
Weakness: CWE-190
Which versions are affected by CVE-2021-32489?
It affects 1 product.
Products include Yubico Yubihsm-Shell.
How do I fix CVE-2021-32489?
No fix has been published for CVE-2021-32489 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-32489 being exploited?
There is no known exploitation of CVE-2021-32489 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cmx7-7xm2-m73q.