CVE-2019-12210

NONE EPSS 76.7%
Published Jun 4, 20197y ago · Modified Jun 17, 20262w ago
Find Similar
Published Jun 4, 2019 7y ago
Last Modified Jun 17, 2026 2w ago

Description

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Threat Intelligence

EPSS Exploit Probability
76.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Affected Products 1

VendorProductVersionRange
yubicopam-u2f1.0.7any

References 5

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html
  • openwall.com http://www.openwall.com/lists/oss-security/2019/06/05/1
    ExploitMailing ListThird Party Advisory
  • developers.yubico.com https://developers.yubico.com/pam-u2f/Release_Notes.html
    Release NotesVendor Advisory
  • github.com https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62
    PatchThird Party Advisory