[SECURITY] [DLA 2141-1] yubikey-val security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Package : yubikey-val
Version : 2.27-1+deb8u1
CVE ID : CVE-2020-10184 CVE-2020-10185
The following CVEs were reported against yubikey-val.
CVE-2020-10184
The verify endpoint in YubiKey Validation Server before 2.40 does
not check the length of SQL queries, which allows remote attackers
to cause a denial of service, aka SQL injection.
CVE-2020-10185
The sync endpoint in YubiKey Validation Server before 2.40 allows
remote attackers to replay an OTP.
For Debian 8 "Jessie", these problems have been fixed in version
2.27-1+deb8u1.
We recommend that you upgrade your yubikey-val packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Best,
Utkarsh
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAl5qn68ACgkQgj6WdgbD
S5awyg//YZ0R9kH/4hX4QSKQ4iTGmFvmoa07JHGdyfnb+JGGXaGxsVfLFU32p7gQ
3pOAsjuvw2UyFA+90uLSA/I9qwXYZE7kuPGkgfBVxbqsj2o/eeIpWZo6gNDuosHY
ssN4+JiNTStvh38JtfQEZ+QSfSIDKFgxdnn1ojO1+UWxAJadzStkkLS0yImEySvI
IGQC0gWg6Z3T1OVJXQM3Q+4U6/T6gRCunckctwFFG6m9eqxYPLCncP6kwq08N4JR
T1PiaiYSSCmaIzP6hHjn0bzDizdUbUimAD0jUqR1uFeca0cayMiaWXE09pU5Xqhd
2ftZWDGVrPVpWFxkKXIRZcBtkyYies/cULzRKuT5Pv3oUUf2pzvux7NWk4vtfbXG
mgnVG7z0jZE/x3BmoIVgKD4mHxXc8t810qe3xW5GJ692S6y4Rx0C6raVAnFpM73t
hMLA6AeAUupqOghcNZGETbfWV1dSOpzhGP+nK6y6nurUn8/5xW9zcPiufm350Kg2
pTmSYJ9dF9e28oo+6xOzudVs/dE5tVSLNsE0EG8hJMywShsHAB4z/UbHIL6hIBoy
cRjW9Plfb9/8XflBW9HVfmE1lamZqdslrxLygjhZgGEhXTVIoPCVqZ6mF6067T1i
YQZXpm8ss0eZw7/UnLnRGKGmFRslVXlQOBLkpPKaiKdWLsWfAQg=
=skwG
-----END PGP SIGNATURE-----
Reply to: