CVE-2021-27217

An issue was discovered in the sendsecuremsg function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length field of an authenticated message received from the device. Out-of-bounds reads performed by aesremovepadding can crash the running process,...

CVE-2021-27217

CVE-2021-27217 affects yubihsm-shell up to version 2.0.3. The _send_secure_msg() function fails to properly validate the embedded length field of an authenticated device message, enabling out-of-bounds reads in aes_remove_padding() that can crash the process and cause a client-side denial of serv...