GHSA-8m9g-647g-5pxw

Suggest an improvement
Source
https://github.com/advisories/GHSA-8m9g-647g-5pxw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-8m9g-647g-5pxw/GHSA-8m9g-647g-5pxw.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-8m9g-647g-5pxw
Aliases
Published
2022-02-15T01:57:18Z
Modified
2023-11-01T04:55:01.106080Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:R CVSS Calculator
Summary
Infinite loop in Yubico yubihsm-connector
Details

An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send it data, preventing any further operations until the yubihsm-connector is restarted. An attacker can send 0, 1, or 2 bytes to trigger this.

Database specific
{
    "nvd_published_at": "2021-04-14T18:15:00Z",
    "cwe_ids": [
        "CWE-835"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-07T16:04:45Z"
}
References

Affected packages

Go / github.com/Yubico/yubihsm-connector

Package

Name
github.com/Yubico/yubihsm-connector
View open source insights on deps.dev
Purl
pkg:golang/github.com/Yubico/yubihsm-connector

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.1