CVE-2020-24612

An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok...

CVE-2020-24612

An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok...

CVE-2020-24612

The CVE-2020-24612 issue affects the selinux-policy (Reference Policy) package 3.14–2020-08-24, where mishandling of the .config/Yubico directory in SELinux-enforced mode prevents pam-u2f from reading a user's U2F configuration. If nouserok is used, and the file cannot be read, second-factor auth...

DiceKeys

DiceKeys is a physical mechanism for creating and storing a 192-bit key. The idea is that you roll a special set of twenty-five dice, put them into a plastic jig, and then use an app to convert those dice into a key. You can then use that key for a variety of purposes, and regenerate it from the...

OpenSSH 8.2 Just Works with U2F/FIDO2 Security Keys

OpenSSH is on a roll. In February, OpenSSH 8.2 introduced first-class support for FIDO2 nee U2F security keys, making hardware backed keys accessible for less than $20. This is not some complicated PAM setup, or some janky cryptographic trick, but a proper public key type, where the private key i...

OpenSSH now supports FIDO U2F security keys for 2-factor authentication

Here's excellent news for sysadmins. You can now use a physical security key as hardware-based two-factor authentication to securely log into a remote system via SSH protocol. OpenSSH, one of the most widely used open-source implementations of the Secure Shell SSH Protocol, yesterday announced th...

CVE-2019-18672

Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing...

Design/Logic Flaw

Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing...

CVE-2019-18672

The affected product is the ShapeShift KeepKey hardware wallet. The issue stems from insufficient checks in the device’s finite state machine prior to firmware 6.2.2, which allows a partial reset of cryptographic secrets to known values via crafted messages. This vulnerability can compromise U2F ...

CVE-2019-18672

Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing...

Fedora Update for pam-u2f FEDORA-2019-cd8f4b9568

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 29 Update: pam-u2f-1.0.8-1.fc29

The PAM U2F module provides an easy way to integrate the Yubikey or other U2F-compliant authenticators into your existing user authentication infrastructure...

The vulnerability of the $HOME/.config/Yubico/u2f_keys authentication file is related to the PAM module Yubico’s pam-u2f, which allows a perpetrator to disclose protected information.

The vulnerability of the $HOME/.config/Yubico/u2fKeys authentication file is related to the lack of protection for service data in the PAM module Yubico’s pam-u2f. Exploiting this vulnerability allows a malicious actor to disclose the protected information...

The vulnerability of the Yubico pam-u2f PAM module lies in the lack of protection for service data, allowing attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Yubico pam-u2f PAM module is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

Fedora 30 : pam-u2f (2019-b6d3c8b0a8)

New upstream release Fixes Debug file descriptor leak CVE-2019-1221 Fixes insecure debug file handling CVE-2019-1220 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Fedora Update for pam-u2f FEDORA-2019-b6d3c8b0a8

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: pam-u2f-1.0.8-1.fc30

The PAM U2F module provides an easy way to integrate the Yubikey or other U2F-compliant authenticators into your existing user authentication infrastructure...

[ASA-201906-5] pam-u2f: information disclosure

Arch Linux Security Advisory ASA-201906-5 ========================================= Severity: Medium Date : 2019-06-07 CVE-ID : CVE-2019-12209 CVE-2019-12210 Package : pam-u2f Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-973 Summary ======= The package pam-u...

Yubico pam-u2f information disclosure vulnerability

Yubico pam-u2f is a portable authentication module for U2F. An information disclosure vulnerability exists in Yubico pam-u2f version 1.0.7. The vulnerability stems from an error in configuration or other errors in the operation of a networked system or product. An unauthorized attacker could...

Yubico pam-u2f information disclosure vulnerability

Yubico pam-u2f is a portable authentication module for U2F. An information disclosure vulnerability exists in Yubico pam-u2f version 1.0.7. The vulnerability stems from an error in configuration or other errors in the operation of a networked system or product. An unauthorized attacker could...