CVE-2024-45678

Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.

• CWE-203
• CWE-203

• https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/Press/Media Coverage
• https://news.ycombinator.com/item?id=41434500Issue Tracking
• https://ninjalab.io/eucleak/Third Party Advisory
• https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdfTechnical Description
• https://support.yubico.com/hc/en-us/articles/15705749884444Mitigation, Third Party Advisory
• https://www.yubico.com/support/security-advisories/ysa-2024-03/Vendor Advisory

Published

Sep 3, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45671IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7…7.5
• CVE-2024-45672IBM Security Verify Bridge 1.0.0 through 1.0.15 could allow …6
• CVE-2024-45673IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.…5.5
• CVE-2024-45674IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.…3.3
• CVE-2024-45675IBM Informix Dynamic Server 14.10 could allow a local user o…7.8
• CVE-2024-45676IBM Cognos Controller 11.0.0 and 11.0.1 could allow …4.3
• CVE-2024-45679Heap-based buffer overflow vulnerability in Assimp versions …8.4
• CVE-2024-4568In Xpdf 4.05 (and earlier), a PDF object loop in the PDF res…5.5
• CVE-2024-45682There is a command injection vulnerability that may allow an…9.8
• CVE-2024-45687Improper Neutralization of CRLF Sequences in HTTP Headers ('…2.4
• CVE-2024-45689A flaw was found in Moodle. Dynamic tables did not enforce c…6.5
• CVE-2024-4569The Elementor Addon Elements plugin for WordPress is vulnera…5.4