CVE-2020-10185: Authentication Bypass by Capture-replay

The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT...

PT-2020-11961

Name of the Vulnerable Software and Affected Versions YubiKey Validation Server versions prior to 2.40 Description The issue allows remote attackers to replay an OTP via the sync endpoint. This is potentially relevant to operators of self-hosted OTP validation services with non-default...

PT-2020-11960

Name of the Vulnerable Software and Affected Versions YubiKey Validation Server versions prior to 2.40 Description The issue concerns a denial of service, potentially related to SQL injection, due to the verify endpoint not checking the length of SQL queries in the YubiKey Validation Server. This...

Debian DLA-345-1 : strongswan security update

Tobias Brunner found an authentication bypass vulnerability in strongSwan, an IKE/IPsec suite. Due to insufficient validation of its local state the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin can be tricked into successfully concluding the authentication without...