8.1

CVE-2019-12210

Exploit

EPSS 0.36%
Published 04.06.2019 21:29:00
Last modified 21.11.2024 04:22:25
Source cve@mitre.org
Teams watchlist Login
Open Login

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Affected products Warnungen 0 Metrics 3 CWE 0 References 8

Data is provided by the National Vulnerability Database (NVD)

Yubico ≫ Pam-u2f Version1.0.7

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.36%	0.573

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.1	2.8	5.2	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov	5.5	8	4.9	AV:N/AC:L/Au:S/C:P/I:P/A:N

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html

http://www.openwall.com/lists/oss-security/2019/06/05/1

Third Party Advisory

Exploit

Mailing List

https://developers.yubico.com/pam-u2f/Release_Notes.html

Vendor Advisory

Release Notes

https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62

Patch

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-12210

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-12210

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-12210

EUVD