CVE-2020-13132

NameCVE-2020-13132
DescriptionAn issue was discovered in Yubico libykpiv before 2.1.0. An attacker can trigger an incorrect free() in the ykpiv_util_generate_key() function in lib/util.c through incorrect error handling code. This could be used to cause a denial of service attack.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitylow
Debian Bugs972644

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
yubico-piv-tool (PTS)stretch1.4.2-2+deb9u2fixed
bullseye, sid2.0.0-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
yubico-piv-toolsourcestretch(not affected)
yubico-piv-toolsource(unstable)(unfixed)972644

Notes

[stretch] - yubico-piv-tool <not-affected> (Vulnerable code not present)
https://www.yubico.com/support/security-advisories/ysa-2020-02/
https://blog.inhq.net/posts/yubico-libykpiv-vuln/

Search for package or bug name: Reporting problems