Debian Security Bug TrackerDEBIANCVE:CVE-2019-12209CVE-2019-12209
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.016 Low
EPSS
Percentile
87.3%
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | pam-u2f | < 1.0.8-1 | pam-u2f_1.0.8-1_all.deb |
| Debian | 11 | all | pam-u2f | < 1.0.8-1 | pam-u2f_1.0.8-1_all.deb |
| Debian | 10 | all | pam-u2f | < 1.0.7-1+deb10u1 | pam-u2f_1.0.7-1+deb10u1_all.deb |
| Debian | 999 | all | pam-u2f | < 1.0.8-1 | pam-u2f_1.0.8-1_all.deb |
| Debian | 13 | all | pam-u2f | < 1.0.8-1 | pam-u2f_1.0.8-1_all.deb |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.016 Low
EPSS
Percentile
87.3%