CVE-2024-45678

Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.

• yubico yubikey 5c nfc firmware (< 5.7) • yubico yubikey 5 nfc firmware (< 5.7) • yubico yubikey 5c firmware (< 5.7) • yubico yubikey 5 nano firmware (< 5.7) • yubico yubikey 5c nano firmware (< 5.7) • yubico yubikey 5ci firmware (< 5.7) • yubico yubikey 5 nfc fips firmware (< 5.7) • yubico yubikey 5c nfc fips firmware (< 5.7) • yubico yubikey 5c fips firmware (< 5.7) • yubico yubikey 5 nano fips firmware (< 5.7) • yubico yubikey 5c nano fips firmware (< 5.7) • yubico yubikey 5ci fips firmware (< 5.7) • yubico yubikey c bio firmware (< 5.7.2) • yubico yubikey bio firmware (< 5.7.2) • yubico security key nfc by yubico firmware (< 5.7) • yubico security key c nfc by yubico firmware (< 5.7) • yubico yubihsm 2 fips firmware (< 2.4.0) • yubico yubihsm 2 firmware (< 2.4.0)