CVE-2018-14779

Name of the Vulnerable Software and Affected Versions Yubico-Piv version 1.5.0

Description A buffer overflow issue was discovered in the Yubico-Piv smartcard driver. The issue arises from the ykpiv transfer data() function in the lib/ykpiv.c file, where the code checks if the output buffer is too small but fails to handle the error properly, potentially leading to a buffer overflow when using memcpy(). This can be triggered by malicious data from a smartcard.

Recommendations For Yubico-Piv version 1.5.0, as a temporary workaround, consider adding proper error handling to the ykpiv transfer data() function to avoid the memcpy() operation when the buffer is too small. At the moment, there is no information about a newer version that contains a fix for this vulnerability.