PT-2019-12999 · Keyidentity · Linotp

Publicado 2019-06-27 · Atualizado 2022-05-24 · CVE-2019-12887

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Crítica

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LinOTP versions prior to 2.10.5.3

Description The issue allows for a replay attack when automatic resynchronization is enabled for the TOTP token type, potentially enabling an attacker to log in with previously recorded OTP values. This attack is only possible if automatic resynchronization is activated, which is deactivated by default. Other token types are unaffected.

Recommendations For versions prior to 2.10.5.3, update to version 2.10.5.3 or later to resolve the issue. As a temporary workaround, consider deactivating the automatic resynchronization for the TOTP token type to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-294

Identificadores relacionados

CVE-2019-12887

GHSA-RQG8-XJP2-PG9W

PYSEC-2019-103

PYSEC-2019-33

Produtos afetados

Linotp

Referências · 10

• https://github.com/LinOTP/LinOTP/commit/6d28d93af59d2ce0d844a6a3282148064efc6ad8 · Nota
• https://github.com/LinOTP/LinOTP · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/linotp/PYSEC-2019-103.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2019-103 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rqg8-xjp2-pg9w · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-33 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12887 · Nota de Segurança
• https://linotp.org/CVE-2019-12887.txt · Nota
• https://osv.dev/vulnerability/CVE-2019-12887 · Aviso do Fabricante
• https://linotp.org/linotp-hotfix-autoresync.html · Nota