PT-2019-12999 · Keyidentity · Linotp

Published 2019-06-27 · Updated 2022-05-24 · CVE-2019-12887

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LinOTP versions prior to 2.10.5.3

Description The issue allows for a replay attack when automatic resynchronization is enabled for the TOTP token type, potentially enabling an attacker to log in with previously recorded OTP values. This attack is only possible if automatic resynchronization is activated, which is deactivated by default. Other token types are unaffected.

Recommendations For versions prior to 2.10.5.3, update to version 2.10.5.3 or later to resolve the issue. As a temporary workaround, consider deactivating the automatic resynchronization for the TOTP token type to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2019-12887

GHSA-RQG8-XJP2-PG9W

PYSEC-2019-103

PYSEC-2019-33

Affected Products

Linotp

References · 10

• https://osv.dev/vulnerability/PYSEC-2019-103 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rqg8-xjp2-pg9w · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12887 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12887 · Vendor Advisory
• https://github.com/LinOTP/LinOTP/commit/6d28d93af59d2ce0d844a6a3282148064efc6ad8 · Note
• https://github.com/LinOTP/LinOTP · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/linotp/PYSEC-2019-103.yaml · Note
• https://linotp.org/CVE-2019-12887.txt · Note
• https://linotp.org/linotp-hotfix-autoresync.html · Note