High severity · published Jun 4, 2019
CVE-2019-12209
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that…
7.5
CVSS
2.8%
EPSS
No
On KEV
Description
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Pam-u2f · Yubico
1.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12209
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html
Exploit
http://www.openwall.com/lists/oss-security/2019/06/05/1
Release Notes
https://developers.yubico.com/pam-u2f/Release_Notes.html
Patch
https://github.com/Yubico/pam-u2f/commit/7db3386fcdb454e33a3ea30dcfb8e8960d4c3aa3
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FOR4ADC356JPCHAJI5UXZORLC3VNBPS/
More from Pam-u2f
8.1
CVE-2019-12210
In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned
6.8
CVE-2021-31924
Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass