Every CVE Search/ Get API key

CVE-2019-12210

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using...

8.1 HighFix available

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

2.06%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Record
CVE-2019-12210
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
5.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:N
Updated
2026-11-02
CVE List No score

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Record
CVE-2019-12210
Updated
2026-11-02
EUVDEUVD-2019-3855 No score

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Record
EUVD-2019-3855
Updated
2026-11-03
GitHub AdvisoriesGHSA-pxf2-5pmm-5r8f 8.1

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using...

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Record
GHSA-pxf2-5pmm-5r8f
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSV 8.1

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Record
CVE-2019-12210
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2019-12210 8.1

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Record
DEBIAN-CVE-2019-12210
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2019-12210 8.1

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Record
UBUNTU-CVE-2019-12210
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2019:1708-1 No score

Security update for libu2f-host, pam_u2f

This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:

Security issues fixed for libu2f-host:

  • CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).

Security issues fixed for pam_u2f:

  • CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).
  • CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1708-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1725-1 No score

Security update for libu2f-host, pam_u2f

This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:

Security issues fixed for libu2f-host:

  • CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).

Security issues fixed for pam_u2f:

  • CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).
  • CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1725-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11145-1 No score

pam_u2f-1.1.1-1.3 on GA media

These are all security issues fixed in the pam_u2f-1.1.1-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11145-1
Updated
2026-11-02
OSVSUSE-SU-2019:1749-1 No score

Security update for libu2f-host

This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:

Security issues fixed for libu2f-host:

  • CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).
  • CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781).

Security issues fixed for pam_u2f:

  • CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).
  • CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).
Record
SUSE-SU-2019:1749-1
Updated
2026-11-02
OSVSUSE-SU-2019:1750-1 No score

Security update for libu2f-host, pam_u2f

This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:

Security issues fixed for libu2f-host:

  • CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).

Security issues fixed for pam_u2f:

  • CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).
  • CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).
Record
SUSE-SU-2019:1750-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pam-u2f
Debian:12
 before 1.0.8-1
1.0.8-1
pam-u2f
Debian:13
 before 1.0.8-1
1.0.8-1
pam-u2f
Debian:14
 before 1.0.8-1
1.0.8-1
libu2f-host
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 4 CVEs
 before 1.1.6-3.5.1
1.1.6-3.5.1
pam_u2f
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 4 CVEs
 before 1.0.8-3.3.1
1.0.8-3.3.1
libu2f-host
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 4 CVEs
 before 1.1.6-3.5.1
1.1.6-3.5.1
pam_u2f
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 4 CVEs
 before 1.0.8-3.3.1
1.0.8-3.3.1
libu2f-host
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 4 CVEs
 before 1.1.6-3.5.1
1.1.6-3.5.1
pam_u2f
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 4 CVEs
 before 1.0.8-3.3.1
1.0.8-3.3.1
libu2f-host
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 3 CVEs
 before 1.1.6-3.6.1
1.1.6-3.6.1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
pam_u2f
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 3 CVEs
 before 1.0.8-3.3.1
1.0.8-3.3.1
libu2f-host
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 3 CVEs
 before 1.1.6-3.6.1
1.1.6-3.6.1
pam_u2f
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 3 CVEs
 before 1.0.8-3.3.1
1.0.8-3.3.1
libu2f-host
openSUSE:Leap 15.1
From an advisory covering 3 CVEs
 before 1.1.6-lp151.2.6.1
1.1.6-lp151.2.6.1
pam_u2f
openSUSE:Leap 15.1
From an advisory covering 3 CVEs
 before 1.0.8-lp151.2.3.1
1.0.8-lp151.2.3.1
libu2f-host
openSUSE:Leap 15.0
From an advisory covering 3 CVEs
 before 1.1.6-lp150.10.1
1.1.6-lp150.10.1
pam_u2f
openSUSE:Leap 15.0
From an advisory covering 3 CVEs
 before 1.0.8-lp150.7.1
1.0.8-lp150.7.1
pam_u2f
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.1.1-1.3
1.1.1-1.3

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-12210 is a high vulnerability (CVSS 8.1) in Yubico Pam-u2f, published June 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.06%, the 81st percentile. Fixed in pam-u2f 1.0.8-1.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open