CVE-2015-3298

Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even though the PIN has not been validated.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2022-03-30

Last modified

2024-08-06

Weaknesses

CWE-347

Affected products

• Ykneo-openpgp (Yubico)

References

• https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html