Every CVE Search/ Get API key

CVE-2024-9312

Authd allows attacker-controlled usernames to yield controllable UIDs

7.5 HighFix available

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.28%Up 0.2 points since Oct 11, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

Record
CVE-2024-9312
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-286
Updated
2026-11-02
EUVDEUVD-2024-2934 7.5

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

Record
EUVD-2024-2934
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-4gfw-wf7c-w6g2 5.5

Authd allows attacker-controlled usernames to yield controllable UIDs

CVE description:

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

----- original report -----

Cause

authd assigns user IDs as a pure function of the user name. Moreover, the set of UIDs is much too small for pseudo-random assignment to work: the birthday bound predicts random collisions will occur with probability 50% after only 54 562 IDs were assigned.

authd only checks for uniqueness within its local cache, which

  • may be inconsistent across multiple systems within the same domain ;
  • may be purged, due to being stored in /var/cache ;
  • automatically removes entries of users who have not logged into that specific system within the last 6 months.

The current GenerateID method, authored in September 2024 (commit a6c85ed24b8d17a2d11c859e8d70f5a52fa69690), repeatedly hashes the user name until the 4 leading bytes fall into the interval [60 000; 2³¹[ : https://github.com/ubuntu/authd/blob/f9f851540e6377fca18a45ce7a02d024c1dbd6e9/internal/users/manager.go#L425 https://github.com/ubuntu/authd/blob/f9f851540e6377fca18a45ce7a02d024c1dbd6e9/internal/services/nss/nss.go#L188

Previous versions are affected by similar issues, though without the use of a cryptographic hash in GenerateID, making exploitation computationally-easier.

Impact

Since GenerateID is a pure function with no secret input, and the set of UIDs is small, an adversary which can register users with chosen names can

  • register multiple users with colliding IDs, or
  • register a single user whose ID collides with a target user's, whether one managed by authd, or a system user whose well-known ID is in a range which overlaps authd's.

In the latter case, as all access control performed by the Linux kernel (and other Unices' kernels) is based on IDs and not usernames, if the attacker can sign into a system, they will have the same privileges as the target user. The attacker can bypass the uniqueness check in (at least) the following ways:

  • engineer a situation where the system administrator purges /var/cache ;
  • target a system account whose UID is in authd's range ;
  • target an account which hasn't logged into a specific system in more than 6 months. Note that this isn't limited to inactive accounts within the entire domain, and impersonation on a given system can potentially be leveraged to compromise the target account on other systems; for example:
    • user alice is known to log into 1.example.com ;
    • the attacker computes a preimage (a username which yields the same UID), let's call it bob ;
    • the attacker creates the account bob and logs into 2.example.com, succeeding if alice hasn't (recently) logged into that system ;
    • the attacker can now manipulate resources exposed on 2 as if they were alice; assuming /home is shared, they could manipulate ~alice/.ssh/authorized_keys, ~alice/.config, alice's shell's initialization file, etc. Note: NFSv4's idmap mechanism may prevent this, but isn't enabled by default (unless Kerberos is used, which isn't the case in an authd deployment)
    • at that point, gaining code execution as alice on 1.example.com is usually trivial.

Since the necessary computation can be performed entirely offline, this wouldn't be affected by any rate-limits, and the only audit trail would be a single user registration. This would require on average less than 2³¹ computations of GenerateID: assuming SHA-256's cost is 25 cycles-per-byte, a clock speed of 3GHz, and short (≤32B) generated usernames, this is less than 10 minutes of a single core's time.

Remediation

The simplest and likely-best remediation…

Record
GHSA-4gfw-wf7c-w6g2
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-286
Updated
2026-11-02
NVD 7.5

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

Record
CVE-2024-9312
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-286, CWE-335
Updated
2026-11-02
OSV 7.5

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

Record
CVE-2024-9312
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-286
Updated
2026-11-02
OSVGHSA-4gfw-wf7c-w6g2 5.5

Authd allows attacker-controlled usernames to yield controllable UIDs

CVE description:

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

----- original report -----

Cause

authd assigns user IDs as a pure function of the user name. Moreover, the set of UIDs is much too small for pseudo-random assignment to work: the birthday bound predicts random collisions will occur with probability 50% after only 54 562 IDs were assigned.

authd only checks for uniqueness within its local cache, which

  • may be inconsistent across multiple systems within the same domain ;
  • may be purged, due to being stored in /var/cache ;
  • automatically removes entries of users who have not logged into that specific system within the last 6 months.

The current GenerateID method, authored in September 2024 (commit a6c85ed24b8d17a2d11c859e8d70f5a52fa69690), repeatedly hashes the user name until the 4 leading bytes fall into the interval [60 000; 2³¹[ : https://github.com/ubuntu/authd/blob/f9f851540e6377fca18a45ce7a02d024c1dbd6e9/internal/users/manager.go#L425 https://github.com/ubuntu/authd/blob/f9f851540e6377fca18a45ce7a02d024c1dbd6e9/internal/services/nss/nss.go#L188

Previous versions are affected by similar issues, though without the use of a cryptographic hash in GenerateID, making exploitation computationally-easier.

Impact

Since GenerateID is a pure function with no secret input, and the set of UIDs is small, an adversary which can register users with chosen names can

  • register multiple users with colliding IDs, or
  • register a single user whose ID collides with a target user's, whether one managed by authd, or a system user whose well-known ID is in a range which overlaps authd's.

In the latter case, as all access control performed by the Linux kernel (and other Unices' kernels) is based on IDs and not usernames, if the attacker can sign into a system, they will have the same privileges as the target user. The attacker can bypass the uniqueness check in (at least) the following ways:

  • engineer a situation where the system administrator purges /var/cache ;
  • target a system account whose UID is in authd's range ;
  • target an account which hasn't logged into a specific system in more than 6 months. Note that this isn't limited to inactive accounts within the entire domain, and impersonation on a given system can potentially be leveraged to compromise the target account on other systems; for example:
    • user alice is known to log into 1.example.com ;
    • the attacker computes a preimage (a username which yields the same UID), let's call it bob ;
    • the attacker creates the account bob and logs into 2.example.com, succeeding if alice hasn't (recently) logged into that system ;
    • the attacker can now manipulate resources exposed on 2 as if they were alice; assuming /home is shared, they could manipulate ~alice/.ssh/authorized_keys, ~alice/.config, alice's shell's initialization file, etc. Note: NFSv4's idmap mechanism may prevent this, but isn't enabled by default (unless Kerberos is used, which isn't the case in an authd deployment)
    • at that point, gaining code execution as alice on 1.example.com is usually trivial.

Since the necessary computation can be performed entirely offline, this wouldn't be affected by any rate-limits, and the only audit trail would be a single user registration. This would require on average less than 2³¹ computations of GenerateID: assuming SHA-256's cost is 25 cycles-per-byte, a clock speed of 3GHz, and short (≤32B) generated usernames, this is less than 10 minutes of a single core's time.

Remediation

The simplest and likely-best remediation…

Record
GHSA-4gfw-wf7c-w6g2
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-286
Updated
2026-11-02
Show 5 moreShow less
OSVGO-2024-3188 No score

Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd

Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd

Record
GO-2024-3188
Updated
2026-11-02
OSVopenSUSE-SU-2024:0350-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww
    • GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97
    • GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r
    • GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch
    • GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq
    • GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw
    • GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h
    • GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh
    • GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj

  • Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g
    • GO-2024-3245 CVE-2024-39720
    • GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v

  • Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm
    • GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh

  • Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr
    • GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c
    • GO-2024-3228 GHSA-wcx9-ccpj-hx3c

  • Packaging improvments:

    • Backfill CVE aliases in recent changelog entries

  • Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3207 GHSA-p5wf-cmr4-xrwr
    • GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6
    • GO-2024-3210 CVE-2024-8901
    • GO-2024-3211 CVE-2024-50312
    • GO-2024-3212 GHSA-rjfv-pjvx-mjgv
    • GO-2024-3213 CVE-2024-49380
    • GO-2024-3214 CVE-2024-49381
    • GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7
    • GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv
    • GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc
    • GO-2024-3219 GHSA-7h65-4p22-39j6
    • GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4
    • GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc
    • GO-2024-3222 GHSA-x7xj-jvwp-97rv
    • GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v
    • GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r

  • Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
    • GO-2024-3203 CVE-2024-9486
    • GO-2024-3204 CVE-2024-9594

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
    • GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc
    • GO-2024-3199 GHSA-vv6c-69r6-chg9
    • GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj
    • GO-2024-3201 CVE-2023-22644 Go CVE Numbering Authority IDs added or updated with aliases:
    • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
    • GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6 Go CVE Numbering Authority IDs added or updated with aliases:
    • GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4
    • GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3
    • GO-2024-3163 CVE-2024-47182
    • GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh
    • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
    • GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52
    • GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h
    • GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc
    • GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4
    • GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8
    • GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4
    • GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x
    • GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq
    • GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr
    • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
    • GO-2024-3182 GHSA-wpr2-j6gr-pjw9 *…
Record
openSUSE-SU-2024:0350-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14447-1 No score

govulncheck-vulndb-0.0.20241030T212825-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20241030T212825-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14447-1
Updated
2026-11-02
OSVSUSE-SU-2024:3911-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z ( jsc#PED-11136 )

  • Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm
    • GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh

  • Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr
    • GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c
    • GO-2024-3228 GHSA-wcx9-ccpj-hx3c

  • Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3207 GHSA-p5wf-cmr4-xrwr
    • GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6
    • GO-2024-3210 CVE-2024-8901
    • GO-2024-3211 CVE-2024-50312
    • GO-2024-3212 GHSA-rjfv-pjvx-mjgv
    • GO-2024-3213 CVE-2024-49380
    • GO-2024-3214 CVE-2024-49381
    • GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7
    • GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv
    • GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc
    • GO-2024-3219 GHSA-7h65-4p22-39j6
    • GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4
    • GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc
    • GO-2024-3222 GHSA-x7xj-jvwp-97rv
    • GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v
    • GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r

  • Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
    • GO-2024-3203 CVE-2024-9486
    • GO-2024-3204 CVE-2024-9594

  • Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
    • GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc
    • GO-2024-3199 GHSA-vv6c-69r6-chg9
    • GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj
    • GO-2024-3201 CVE-2023-22644

  • Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
    • GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6

  • Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4
    • GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3
    • GO-2024-3163 CVE-2024-47182
    • GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh
    • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
    • GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52
    • GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h
    • GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc
    • GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4
    • GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8
    • GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4
    • GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x
    • GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq
    • GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr
    • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
    • GO-2024-3182 GHSA-wpr2-j6gr-pjw9
    • GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m
    • GO-2024-3185 CVE-2024-47832
    • GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp
    • GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2
    • GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226
    • GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j
Record
SUSE-SU-2024:3911-1
Updated
2026-11-02
OSVSUSE-SU-2025:0429-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20250207T224745 2025-02-07T22:47:45Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3456 CVE-2025-24786 GHSA-9r4c-jwx3-3j76
    • GO-2025-3457 CVE-2025-24787 GHSA-c7w4-9wv8-7x7c
    • GO-2025-3458 CVE-2025-24366 GHSA-vj7w-3m8c-6vpx

  • Update to version 0.0.20250206T175003 2025-02-06T17:50:03Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2023-1867 CVE-2022-47930 GHSA-c58h-qv6g-fw74
    • GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g

  • Update to version 0.0.20250206T165438 2025-02-06T16:54:38Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3428 CVE-2025-22867
    • GO-2025-3447 CVE-2025-22866

  • Update to version 0.0.20250205T232745 2025-02-05T23:27:45Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3408
    • GO-2025-3448 GHSA-23qp-3c2m-xx6w
    • GO-2025-3449 GHSA-mx2j-7cmv-353c
    • GO-2025-3450 GHSA-w7wm-2425-7p2h
    • GO-2025-3454 GHSA-mj4v-hp69-27x5
    • GO-2025-3455 GHSA-vqv5-385r-2hf8

  • Update to version 0.0.20250205T003520 2025-02-05T00:35:20Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3451

  • Update to version 0.0.20250204T220613 2025-02-04T22:06:13Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3431 CVE-2025-24884 GHSA-hcr5-wv4p-h2g2
    • GO-2025-3433 CVE-2025-23216 GHSA-47g2-qmh2-749v
    • GO-2025-3434 CVE-2025-24376 GHSA-fc89-jghx-8pvg
    • GO-2025-3435 CVE-2025-24784 GHSA-756x-m4mj-q96c
    • GO-2025-3436 CVE-2025-24883 GHSA-q26p-9cq4-7fc2
    • GO-2025-3437 GHSA-274v-mgcv-cm8j
    • GO-2025-3438 CVE-2024-11741 GHSA-wxcc-2f3q-4h58
    • GO-2025-3442 CVE-2025-24371 GHSA-22qq-3xwm-r5x4
    • GO-2025-3443 GHSA-r3r4-g7hq-pq4f
    • GO-2025-3444 CVE-2024-35177
    • GO-2025-3445 CVE-2024-47770

  • Use standard RPM macros to unpack the source and populate a working directory. Fixes build with RPM 4.20.

  • Update to version 0.0.20250130T185858 2025-01-30T18:58:58Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-2842 CVE-2024-3727 GHSA-6wvf-f2vw-3425
    • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
    • GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2
    • GO-2025-3372 CVE-2024-45339 GHSA-6wxm-mpqj-6jpf
    • GO-2025-3373 CVE-2024-45341
    • GO-2025-3383 CVE-2024-45340
    • GO-2025-3408
    • GO-2025-3412 CVE-2024-10846 GHSA-36gq-35j3-p9r9
    • GO-2025-3420 CVE-2024-45336
    • GO-2025-3421 CVE-2025-22865
    • GO-2025-3424 CVE-2025-24369
    • GO-2025-3426 CVE-2025-0750 GHSA-hp5j-2585-qx6g
    • GO-2025-3427 CVE-2024-13484 GHSA-58fx-7v9q-3g56
Record
SUSE-SU-2025:0429-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/ubuntu/authd
Go
 through 0.0.0-20230706090440-d8cb2d561419 None known
github.com/ubuntu/authd
Go
 before 0.3.6
0.3.6
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 44 CVEs
 before 0.0.20241030T212825-150000.1.9.1
0.0.20241030T212825-150000.1.9.1
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 44 CVEs
 before 0.0.20241030T212825-150000.1.9.1
0.0.20241030T212825-150000.1.9.1
govulncheck-vulndb
openSUSE:Leap 15.5
From an advisory covering 44 CVEs
 before 0.0.20241030T212825-150000.1.9.1
0.0.20241030T212825-150000.1.9.1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 44 CVEs
 before 0.0.20241030T212825-150000.1.9.1
0.0.20241030T212825-150000.1.9.1
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 28 CVEs
 before 0.0.20250207T224745-150000.1.32.1
0.0.20250207T224745-150000.1.32.1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 28 CVEs
 before 0.0.20250207T224745-150000.1.32.1
0.0.20250207T224745-150000.1.32.1
govulncheck-vulndb
SUSE:Package Hub 12
From an advisory covering 56 CVEs
 before 0.0.20241104T154416-5.1
0.0.20241104T154416-5.1
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 44 CVEs
 before 0.0.20241030T212825-1.1
0.0.20241030T212825-1.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-9312 is a high vulnerability (CVSS 7.5) in Canonical Authd, published October 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in github.com/ubuntu/authd 0.3.6.

References

Show 85 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open