CVE-2020-13132

An issue was discovered in Yubico libykpiv before 2.1.0. An attacker can trigger an incorrect free() in the ykpiv_util_generate_key() function in lib/util.c through incorrect error handling code. This could be used to cause a denial of service attack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.6 MEDIUM
PHYSICAL
LOW
NONE
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
4.3 MEDIUM
PHYSICAL
LOW
NONE
CVSS:3.0/AC:L/AV:P/A:H/C:N/I:N/PR:N/S:U/UI:R
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
VendorProductVersion
yubicolibykpiv
𝑥
< 2.1.0
yubicopiv_tool_manager
𝑥
< 2.0.0
yubicoyubikey_smart_card_minidriver
𝑥
≤ 4.1.0.172
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
yubico-piv-tool
bullseye
2.2.0-1
fixed
stretch
not-affected
bookworm
2.2.0-1.1
fixed
sid
2.5.2-1
fixed
trixie
2.5.2-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
yubico-piv-tool
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
ignored
focal
needs-triage
eoan
ignored
bionic
needs-triage
xenial
needs-triage
trusty
dne
Common Weakness Enumeration
References
https://blog.inhq.net/posts/yubico-libykpiv-vuln/
https://www.yubico.com/support/security-advisories/ysa-2020-02/
https://blog.inhq.net/posts/yubico-libykpiv-vuln/
https://www.yubico.com/support/security-advisories/ysa-2020-02/