The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service; the issue does NOT affect YubiCloud.
References
| Link | Resource |
|---|---|
| https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40 | Release Notes Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2020/03/msg00014.html | |
| https://www.yubico.com/support/security-advisories/ysa-2020-01/ | Exploit Vendor Advisory |
| https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40 | Release Notes Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2020/03/msg00014.html | |
| https://www.yubico.com/support/security-advisories/ysa-2020-01/ | Exploit Vendor Advisory |
Configurations
History
21 Nov 2024, 04:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40 - Release Notes, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2020/03/msg00014.html - | |
| References | () https://www.yubico.com/support/security-advisories/ysa-2020-01/ - Exploit, Vendor Advisory |
Information
Published : 2020-03-05 23:15
Updated : 2024-11-21 04:54
NVD link : CVE-2020-10184
Mitre link : CVE-2020-10184
CVE.ORG link : CVE-2020-10184
JSON object : View
Products Affected
yubico
- yubikey_one_time_password_validation_server
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')