未評価
The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to perso...
CVE-2020-10185
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT affect YubiCloud.
参照URL
- advisory github.com
- report yubico.com
- web lists.debian.org