CVE-2021-27217

An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length field of an authenticated message received from the device. Out-of-bounds reads performed by aes_remove_padding() can crash the running process, depending on the memory layout. This could be used by an attacker to cause a client-side denial of service. The yubihsm-shell project is included in the YubiHSM 2 SDK product.

• CWE-125

• https://blog.inhq.net/posts/yubico-libyubihsm-vuln2Exploit, Third Party Advisory
• https://github.com/Yubico/yubihsm-shell/releasesRelease Notes, Third Party Advisory
• https://www.yubico.com/support/security-advisories/ysa-2021-01/Vendor Advisory
• https://blog.inhq.net/posts/yubico-libyubihsm-vuln2Exploit, Third Party Advisory
• https://github.com/Yubico/yubihsm-shell/releasesRelease Notes, Third Party Advisory
• https://www.yubico.com/support/security-advisories/ysa-2021-01/Vendor Advisory

Published

Mar 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27211steghide 0.5.1 relies on a certain 32-bit seed value, which …7.5
• CVE-2021-27212In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an …7.5
• CVE-2021-27213config.py in pystemon before 2021-02-13 allows code executio…9.8
• CVE-2021-27214A Server-side request forgery (SSRF) vulnerability in the Pr…6.1
• CVE-2021-27215An issue was discovered in genua genugate before 9.0 Z p19, …9.8
• CVE-2021-27216Exim 4 before 4.94.2 has Execution with Unnecessary Privileg…6.3
• CVE-2021-27218An issue was discovered in GNOME GLib before 2.66.7 and 2.67…7.5
• CVE-2021-27219An issue was discovered in GNOME GLib before 2.66.6 and 2.67…7.5
• CVE-2021-27220An issue was discovered in PRTG Network Monitor before 21.1.…5.3
• CVE-2021-27221MikroTik RouterOS 6.47.9 allows remote authenticated ftp use…8.1
• CVE-2021-27222In the "Time in Status" app before 4.13.0 for Jira, remote a…5.4
• CVE-2021-27223A denial-of-service issue existed in one of modules that was…5.5