7.5
CVE-2023-39908
- EPSS 0.21%
- Published 14.08.2023 19:15:13
- Last modified 21.11.2024 08:16:00
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory.
Data is provided by the National Vulnerability Database (NVD)
Yubico ≫ Yubihsm 2 Sdk Version < 2023.08
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.21% | 0.433 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-125 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.