CVE-2019-12209
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico...
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
- Record
CVE-2019-12209- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
- Record
CVE-2019-12209- Updated
- 2026-11-02
EUVDEUVD-2019-3854 No score
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
- Record
EUVD-2019-3854- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cf2r-5chq-jmm8
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico...
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
- Record
GHSA-cf2r-5chq-jmm8- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
- Record
CVE-2019-12209- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12209
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
- Record
DEBIAN-CVE-2019-12209- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2019-12209
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
- Record
UBUNTU-CVE-2019-12209- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1708-1 No score
Security update for libu2f-host, pam_u2f
This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:
Security issues fixed for libu2f-host:
- CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).
Security issues fixed for pam_u2f:
- CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).
- CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1708-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1725-1 No score
Security update for libu2f-host, pam_u2f
This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:
Security issues fixed for libu2f-host:
- CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).
Security issues fixed for pam_u2f:
- CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).
- CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1725-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11145-1 No score
pam_u2f-1.1.1-1.3 on GA media
These are all security issues fixed in the pam_u2f-1.1.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11145-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1749-1 No score
Security update for libu2f-host
This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:
Security issues fixed for libu2f-host:
- CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).
- CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781).
Security issues fixed for pam_u2f:
- CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).
- CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).
- Record
SUSE-SU-2019:1749-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1750-1 No score
Security update for libu2f-host, pam_u2f
This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:
Security issues fixed for libu2f-host:
- CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).
Security issues fixed for pam_u2f:
- CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).
- CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).
- Record
SUSE-SU-2019:1750-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pam-u2fDebian:12 |
before 1.0.8-1 | 1.0.8-1 |
pam-u2fDebian:13 |
before 1.0.8-1 | 1.0.8-1 |
pam-u2fDebian:14 |
before 1.0.8-1 | 1.0.8-1 |
libu2f-hostSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 4 CVEs |
before 1.1.6-3.5.1 | 1.1.6-3.5.1 |
pam_u2fSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 4 CVEs |
before 1.0.8-3.3.1 | 1.0.8-3.3.1 |
libu2f-hostSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 4 CVEs |
before 1.1.6-3.5.1 | 1.1.6-3.5.1 |
pam_u2fSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 4 CVEs |
before 1.0.8-3.3.1 | 1.0.8-3.3.1 |
libu2f-hostSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 4 CVEs |
before 1.1.6-3.5.1 | 1.1.6-3.5.1 |
pam_u2fSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 4 CVEs |
before 1.0.8-3.3.1 | 1.0.8-3.3.1 |
libu2f-hostSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 3 CVEs |
before 1.1.6-3.6.1 | 1.1.6-3.6.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pam_u2fSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 3 CVEs |
before 1.0.8-3.3.1 | 1.0.8-3.3.1 |
libu2f-hostSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 3 CVEs |
before 1.1.6-3.6.1 | 1.1.6-3.6.1 |
pam_u2fSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 3 CVEs |
before 1.0.8-3.3.1 | 1.0.8-3.3.1 |
libu2f-hostopenSUSE:Leap 15.1 From an advisory covering 3 CVEs |
before 1.1.6-lp151.2.6.1 | 1.1.6-lp151.2.6.1 |
pam_u2fopenSUSE:Leap 15.1 From an advisory covering 3 CVEs |
before 1.0.8-lp151.2.3.1 | 1.0.8-lp151.2.3.1 |
libu2f-hostopenSUSE:Leap 15.0 From an advisory covering 3 CVEs |
before 1.1.6-lp150.10.1 | 1.1.6-lp150.10.1 |
pam_u2fopenSUSE:Leap 15.0 From an advisory covering 3 CVEs |
before 1.0.8-lp150.7.1 | 1.0.8-lp150.7.1 |
pam_u2fopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 1.1.1-1.3 | 1.1.1-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12209 is a high vulnerability (CVSS 7.5) in Yubico Pam-u2f, published June 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.81%, the 86th percentile. Fixed in pam-u2f 1.0.8-1.
References
github.com/Yubico/pam-u2f/commit/7db3386fcdb454e33a3ea30dcfb8e8960d4c3aa3
developers.yubico.com/pam-u2f/Release_Notes.html
openwall.com/lists/oss-security/2019/06/05/1
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FOR4ADC356JPCHAJI5UXZORLC3VNBPS
lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html
Show 21 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-12209
security-tracker.debian.org/tracker/CVE-2019-12209
suse.com/support/update/announcement/2019/suse-su-20191749-1
bugzilla.suse.com/1124781
ubuntu.com/security/CVE-2019-12209
cve.org/CVERecord?id=CVE-2019-12209