CVE-2018-19589

Name of the Vulnerable Software and Affected Versions Utimaco CryptoServer HSM (affected versions not specified)

Description The issue concerns incorrect access controls in the PKCS11 R2 provider of the Utimaco CryptoServer HSM product package. This allows a Security Officer (SO) authenticated to a slot to retrieve attributes of and delete private keys in external key storage. The confidentiality and integrity of the affected keys remain unaffected, but their availability is compromised. This could lead to a "reverse ransomware" attack, where an attacker denies legitimate users access to keys while maintaining possession of an encrypted copy of the external key store for ransom. The attack can be executed via a physical connection to the CryptoServer or remotely if SSH or LAN access has been compromised.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.