CVE-2017-12197
Improper Input Validation in libpam4j
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
- Record
CVE-2017-12197- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-863, CWE-20
- Updated
- 2026-11-02
CVE List No score
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
- Record
CVE-2017-12197- Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2022-5757 No score
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
- Record
EUVD-2022-5757- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x9rg-q5fx-fx66
Improper Input Validation in libpam4j
It was found that libpam4j prior to 1.10 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
- Record
GHSA-x9rg-q5fx-fx66- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
- Record
CVE-2017-12197- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-x9rg-q5fx-fx66
Improper Input Validation in libpam4j
It was found that libpam4j prior to 1.10 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
- Record
GHSA-x9rg-q5fx-fx66- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2017:2904
Red Hat Security Advisory: rh-sso7-keycloak security update
- Record
RHSA-2017:2904- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2017:2905
Red Hat Security Advisory: rh-sso7-keycloak security update
- Record
RHSA-2017:2905- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-12197
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
- Record
UBUNTU-CVE-2017-12197- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2018-0234 No score
Updated libpam4j package fixes security vulnerability
It was discovered that libpam4j, a Java library wrapper for the integration of PAM did not call pam_acct_mgmt() during authentication. As such a user who has a valid password, but a deactivated or disabled account could still log in (CVE-2017-12197).
- Record
MGASA-2018-0234- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.kohsuke:libpam4jMaven |
before 1.10 | 1.10 |
libpam4jDebian:7 |
before 1.4-2+deb7u1, plus listed versions 1.4-2 |
1.4-2+deb7u1 |
libpam4jDebian:8 |
before 1.4-2+deb8u1, plus listed versions 1.4-2 |
1.4-2+deb8u1 |
libpam4jDebian:9 |
before 1.4-2+deb9u1, plus listed versions 1.4-2 |
1.4-2+deb9u1 |
org.kohsuke:libpam4jMaven |
before 1.10, plus listed versions 1.51.61.71.81.9 |
1.10 |
libpam4jMageia:6 |
before 1.8-7.1.mga6 | 1.8-7.1.mga6 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 5 CVEs |
before 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 5 CVEs |
before 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 5 CVEs |
before 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 5 CVEs |
before 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 |
libpam4jUbuntu:14.04:LTS |
before 1.4-2+deb8u1build0.14.04.1, plus listed versions 1.4-2 |
1.4-2+deb8u1build0.14.04.1 |
libpam4jUbuntu:16.04:LTS |
before 1.4-2+deb8u1build0.16.04.1, plus listed versions 1.4-2 |
1.4-2+deb8u1build0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12197 is a medium vulnerability (CVSS 6.5) in Libpam4j Project Libpam4j, published November 7, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in org.kohsuke:libpam4j 1.10.
References
lists.debian.org/debian-lts-announce/2017/11/msg00008.html
access.redhat.com/errata/RHSA-2017:2904
debian.org/security/2017/dsa-4025
bugzilla.redhat.com/show_bug.cgi?id=1503103
Show 32 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-12197
github.com/kohsuke/libpam4j/issues/18
advisories.mageia.org/MGASA-2018-0234.html
bugs.mageia.org/show_bug.cgi?id=22006
issues.redhat.com/browse/RHSSO-1121
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2904.json
cve.org/CVERecord?id=CVE-2014-9970
ubuntu.com/security/CVE-2017-12197