[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 2141-1] yubikey-val security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Package        : yubikey-val
Version        : 2.27-1+deb8u1
CVE ID         : CVE-2020-10184 CVE-2020-10185


The following CVEs were reported against yubikey-val.

CVE-2020-10184

    The verify endpoint in YubiKey Validation Server before 2.40 does
    not check the length of SQL queries, which allows remote attackers
    to cause a denial of service, aka SQL injection.

CVE-2020-10185

    The sync endpoint in YubiKey Validation Server before 2.40 allows
    remote attackers to replay an OTP.

For Debian 8 "Jessie", these problems have been fixed in version
2.27-1+deb8u1.

We recommend that you upgrade your yubikey-val packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Best,
Utkarsh
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAl5qn68ACgkQgj6WdgbD
S5awyg//YZ0R9kH/4hX4QSKQ4iTGmFvmoa07JHGdyfnb+JGGXaGxsVfLFU32p7gQ
3pOAsjuvw2UyFA+90uLSA/I9qwXYZE7kuPGkgfBVxbqsj2o/eeIpWZo6gNDuosHY
ssN4+JiNTStvh38JtfQEZ+QSfSIDKFgxdnn1ojO1+UWxAJadzStkkLS0yImEySvI
IGQC0gWg6Z3T1OVJXQM3Q+4U6/T6gRCunckctwFFG6m9eqxYPLCncP6kwq08N4JR
T1PiaiYSSCmaIzP6hHjn0bzDizdUbUimAD0jUqR1uFeca0cayMiaWXE09pU5Xqhd
2ftZWDGVrPVpWFxkKXIRZcBtkyYies/cULzRKuT5Pv3oUUf2pzvux7NWk4vtfbXG
mgnVG7z0jZE/x3BmoIVgKD4mHxXc8t810qe3xW5GJ692S6y4Rx0C6raVAnFpM73t
hMLA6AeAUupqOghcNZGETbfWV1dSOpzhGP+nK6y6nurUn8/5xW9zcPiufm350Kg2
pTmSYJ9dF9e28oo+6xOzudVs/dE5tVSLNsE0EG8hJMywShsHAB4z/UbHIL6hIBoy
cRjW9Plfb9/8XflBW9HVfmE1lamZqdslrxLygjhZgGEhXTVIoPCVqZ6mF6067T1i
YQZXpm8ss0eZw7/UnLnRGKGmFRslVXlQOBLkpPKaiKdWLsWfAQg=
=skwG
-----END PGP SIGNATURE-----


Reply to: