Package: libykpiv1
Version: 1.6.2-1
Severity: serious
Tags: security buster sid upstream fixed-upstream pending
Justification: Security issue
Hi,
Yubico released a new version of libykpiv, mentionning “security fixes” in
the NEWS file, but without publishing a new security advisory.
I believe this refers to the following issues (quoting changelog entries):
* Memory unsafety:
* lib/internal.h, lib/ykpiv.c: lib: tlv length buffer checks
* lib/internal.h, lib/util.c: lib: correct overflow checks in
_write_certificate
* lib/util.c, lib/ykpiv.c: lib: resolves potential reads of
uninitialized data
* Correctly erasing secrets from memory after use:
* lib/util.c: lib: clear secrets in set_protected_mgm
* lib/ykpiv.c: lib: clear secrets in ykpiv_import_private_key
* lib/ykpiv.c: lib: clear secrets in auth api
* lib/internal.c, lib/ykpiv.c: lib: clear buffers containing key
material
* lib/internal.h, lib/util.c: lib: use secure zero memory platform
functions
* lib/ykpiv.c: lib: check internal authentication crypt errors
Given the absence of an advisory, I assume those issues are not known to be
exploitable. However, I believe it would be worth fixing them before the
release of Buster.
Please let me know if a fix should be backported to stretch.
Best,
nicoo
-- System Information:
Debian Release: buster/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 4.19.0-2-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE,
TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL
set to en_US.UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set
to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages libykpiv1 depends on:
ii libc6 2.28-8
ii libpcsclite1 1.8.24-1
ii libssl1.1 1.1.1b-1
Versions of packages libykpiv1 recommends:
ii pcscd 1.8.24-1
libykpiv1 suggests no packages.
-- no debconf information
