CVE-2023-39908 | BDVDB-2026-209665 Detail

Description#

The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.yubico.com/support/security-advisories/ysa-2023-01/
https://blog.inhq.net/posts/yubico-yubihsm-pkcs-vuln/

Exploit#

No public exploit known

History#

Version 12023-08-14Record published in the CVE List.
Version 22024-10-09Most recent update recorded in the CVE List.