Medium severity4.4NVD Advisory· Published Mar 4, 2021· Updated Jun 17, 2026
CVE-2021-27217
CVE-2021-27217
Description
An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length field of an authenticated message received from the device. Out-of-bounds reads performed by aes_remove_padding() can crash the running process, depending on the memory layout. This could be used by an attacker to cause a client-side denial of service. The yubihsm-shell project is included in the YubiHSM 2 SDK product.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- Yubico/yubihsm-shelldescription
<=2.0.3+ 1 more
- (no CPE)range: <=2.0.3
- cpe:2.3:a:yubico:yubihsm-shell:*:*:*:*:*:*:*:*range: <=2.0.3
Patches
Vulnerability mechanics
References
3- blog.inhq.net/posts/yubico-libyubihsm-vuln2nvdExploitThird Party Advisory
- github.com/Yubico/yubihsm-shell/releasesnvdRelease NotesThird Party Advisory
- www.yubico.com/support/security-advisories/ysa-2021-01/nvdVendor Advisory
News mentions
0No linked articles in our index yet.