A yubikey-val security update has been released for Debian GNU/Linux 8 LTS.

Package : yubikey-val
Version : 2.27-1+deb8u1
CVE ID : CVE-2020-10184 CVE-2020-10185

The following CVEs were reported against yubikey-val.

CVE-2020-10184

The verify endpoint in YubiKey Validation Server before 2.40 does
not check the length of SQL queries, which allows remote attackers
to cause a denial of service, aka SQL injection.

CVE-2020-10185

The sync endpoint in YubiKey Validation Server before 2.40 allows
remote attackers to replay an OTP.

For Debian 8 "Jessie", these problems have been fixed in version
2.27-1+deb8u1.

We recommend that you upgrade your yubikey-val packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS