PT-2018-18953 · Yubico · Yubico Pam Module

Marc-Sensenich · Publicado 2018-04-04 · Atualizado 2024-06-15 · CVE-2018-9275

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Yubico PAM module (aka pam yubico) versions 2.18 through 2.25

Description The issue affects the Yubico PAM module, where successful logins can leak file descriptors to the auth mapping file. This can lead to information disclosure, such as the serial number of a device, and/or Denial of Service (DoS) by reaching the maximum number of file descriptors.

Recommendations For Yubico PAM module versions 2.18 through 2.25, update to a version that contains a fix for this issue to prevent information disclosure and potential DoS attacks.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-9275

OPENSUSE-SU-2024:11146-1

Produtos afetados

Yubico Pam Module

Referências · 12

• https://github.com/Yubico/yubico-pam/commit/0f6ceabab0a8849b47f67d727aa526c2656089ba · Correção
• https://github.com/Yubico/yubico-pam/issues/136 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:11146-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-9275 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-9275 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-9275 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-9275 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-9275 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-9275 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-9275 · Aviso do Fabricante
• https://bugzilla.opensuse.org/show_bug.cgi?id=1088027 · Nota
• https://suse.com/security/cve/CVE-2018-9275 · Nota