CVE-2024-45678
Medium
Description
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.
SeverityMedium
CVSS4.2
Exploit probability—
ProductYubico Yubikey 5c Nfc Firmware
PublishedSep 3, 2024
First seenSep 3, 2024
Weakness typeCWE-203CWE-203
How to fix
Update
- yubico yubikey_5c_nfc_firmware5.7 or later
- yubico yubikey_5_nfc_firmware5.7 or later
- yubico yubikey_5c_firmware5.7 or later
- yubico yubikey_5_nano_firmware5.7 or later
- yubico yubikey_5c_nano_firmware5.7 or later
- yubico yubikey_5ci_firmware5.7 or later
- yubico yubikey_5_nfc_fips_firmware5.7 or later
- yubico yubikey_5c_nfc_fips_firmware5.7 or later
- yubico yubikey_5c_fips_firmware5.7 or later
- yubico yubikey_5_nano_fips_firmware5.7 or later
- yubico yubikey_5c_nano_fips_firmware5.7 or later
- yubico yubikey_5ci_fips_firmware5.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yubico yubikey_5c_nfc_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5_nfc_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5c_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5_nano_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5c_nano_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5ci_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5_nfc_fips_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5c_nfc_fips_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5c_fips_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5_nano_fips_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5c_nano_fips_firmware | v < 5.7 | 5.7 |
| yubico yubikey_5ci_fips_firmware | v < 5.7 | 5.7 |
| yubico yubikey_c_bio_firmware | v < 5.7.2 | 5.7.2 |
| yubico yubikey_bio_firmware | v < 5.7.2 | 5.7.2 |
| yubico security_key_nfc_by_yubico_firmware | v < 5.7 | 5.7 |
| yubico security_key_c_nfc_by_yubico_firmware | v < 5.7 | 5.7 |
| yubico yubihsm_2_fips_firmware | v < 2.4.0 | 2.4.0 |
| yubico yubihsm_2_firmware | v < 2.4.0 | 2.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.