PT-2018-18953 · Yubico · Yubico Pam Module

Marc-Sensenich · Published 2018-04-04 · Updated 2024-06-15 · CVE-2018-9275

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Yubico PAM module (aka pam yubico) versions 2.18 through 2.25

Description The issue affects the Yubico PAM module, where successful logins can leak file descriptors to the auth mapping file. This can lead to information disclosure, such as the serial number of a device, and/or Denial of Service (DoS) by reaching the maximum number of file descriptors.

Recommendations For Yubico PAM module versions 2.18 through 2.25, update to a version that contains a fix for this issue to prevent information disclosure and potential DoS attacks.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-9275

OPENSUSE-SU-2024:11146-1

Affected Products

Yubico Pam Module

References · 12

• https://github.com/Yubico/yubico-pam/commit/0f6ceabab0a8849b47f67d727aa526c2656089ba · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:11146-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-9275 · Security Note
• https://ubuntu.com/security/CVE-2018-9275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-9275 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-9275 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-9275 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-9275 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-9275 · Vendor Advisory
• https://github.com/Yubico/yubico-pam/issues/136 · Note
• https://bugzilla.opensuse.org/show_bug.cgi?id=1088027 · Note
• https://suse.com/security/cve/CVE-2018-9275 · Note