{"id":"CVE-2019-12209","aliases":["DEBIAN-CVE-2019-12209","EUVD-2019-3854","GHSA-cf2r-5chq-jmm8","SUSE-SU-2019:1749-1","SUSE-SU-2019:1750-1","UBUNTU-CVE-2019-12209","openSUSE-SU-2019:1708-1","openSUSE-SU-2019:1725-1","openSUSE-SU-2024:11145-1"],"status":"published","title":"Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico...","description":"Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02807,"percentile":0.86594,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2019-06-04T20:26:55Z","modified":"2026-10-20T13:39:47Z","fixes":[{"ecosystem":"Debian:12","package":"pam-u2f","fixed_in":["1.0.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pam-u2f","fixed_in":["1.0.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pam-u2f","fixed_in":["1.0.8-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"pam-u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pam-u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pam-u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"libu2f-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"pam_u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libu2f-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"pam_u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libu2f-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"pam_u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libu2f-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"pam_u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libu2f-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"pam_u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libu2f-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-lp151.2.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"pam_u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-lp151.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libu2f-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-lp150.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"pam_u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-lp150.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pam_u2f","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1.3"}]}],"bundled":3}],"products":[{"vendor":"yubico","product":"pam-u2f"}],"references":[{"url":"https://github.com/Yubico/pam-u2f/commit/7db3386fcdb454e33a3ea30dcfb8e8960d4c3aa3","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://developers.yubico.com/pam-u2f/Release_Notes.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/05/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FOR4ADC356JPCHAJI5UXZORLC3VNBPS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCGU6UQLI3ZTW3UYCTMQW7VDL5M4LCWR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12209"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FOR4ADC356JPCHAJI5UXZORLC3VNBPS"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCGU6UQLI3ZTW3UYCTMQW7VDL5M4LCWR"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FOR4ADC356JPCHAJI5UXZORLC3VNBPS"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCGU6UQLI3ZTW3UYCTMQW7VDL5M4LCWR"},{"url":"https://github.com/advisories/GHSA-cf2r-5chq-jmm8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12209","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191749-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1124781","tags":["report"]},{"url":"https://bugzilla.suse.com/1128140","tags":["report"]},{"url":"https://bugzilla.suse.com/1135727","tags":["report"]},{"url":"https://bugzilla.suse.com/1135729","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9578","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191750-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-12209","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/06/05/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12209","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NLLQFQYZPMUPPGSELE2DVQUEBTEZRB3U/#NLLQFQYZPMUPPGSELE2DVQUEBTEZRB3U","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7L2J54VOSWKWWHDQ3LUR6WDVPL2TE6XB/#7L2J54VOSWKWWHDQ3LUR6WDVPL2TE6XB","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31924","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-12209","description":"Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.","status":"published","published":"2019-06-04T20:26:55Z","modified":"2024-08-04T23:17:38.129Z","updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2019-3854","description":"Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.","status":"published","published":"2019-06-04T20:26:55Z","modified":"2024-08-04T23:17:38Z","updated_at":"2026-11-03T02:40:46.843701Z"}],"ghsa":[{"id":"GHSA-cf2r-5chq-jmm8","title":"Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico...","description":"Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.","status":"published","published":"2022-05-24T16:47:09Z","modified":"2024-04-04T00:51:20Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:55:52.724602Z"}],"nvd":[{"id":"CVE-2019-12209","description":"Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.","status":"published","published":"2019-06-04T21:29:00.78Z","modified":"2026-06-17T02:14:14.767Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:05:16.285679Z"}],"osv":[{"id":"CVE-2019-12209","description":"Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.","status":"published","published":"2019-06-04T21:29:00.78Z","modified":"2026-10-20T13:39:47.393305431Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12209","description":"Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.","status":"published","published":"2019-06-04T21:29:00.78Z","modified":"2026-09-21T07:02:01.070192174Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-12209","description":"Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.","status":"withdrawn","published":"2019-06-04T21:29:00Z","modified":"2025-09-08T16:45:26Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"openSUSE-SU-2019:1708-1","title":"Security update for libu2f-host, pam_u2f","description":"This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:\n\nSecurity issues fixed for libu2f-host: \n\n- CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).\n\nSecurity issues fixed for pam_u2f:\n\n- CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).\n- CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-07-19T05:59:24Z","modified":"2026-02-04T03:34:09.058983Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1725-1","title":"Security update for libu2f-host, pam_u2f","description":"This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:\n\nSecurity issues fixed for libu2f-host: \n\n- CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).\n\nSecurity issues fixed for pam_u2f:\n\n- CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).\n- CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-07-19T15:59:26Z","modified":"2026-02-04T02:44:36.166528Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11145-1","title":"pam_u2f-1.1.1-1.3 on GA media","description":"These are all security issues fixed in the pam_u2f-1.1.1-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:37:23.85028Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:1749-1","title":"Security update for libu2f-host","description":"This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:\n\t  \nSecurity issues fixed for libu2f-host: \n\n- CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).\n- CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow \n  with a custom made malicious USB device (bsc#1124781).\n\nSecurity issues fixed for pam_u2f:\n\n- CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).\n- CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).\n","status":"published","published":"2019-07-04T14:06:56Z","modified":"2026-02-04T04:38:13.599936Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1750-1","title":"Security update for libu2f-host, pam_u2f","description":"This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:\n\nSecurity issues fixed for libu2f-host: \n\n- CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).\n\nSecurity issues fixed for pam_u2f:\n\n- CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).\n- CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).\n","status":"published","published":"2019-07-04T14:07:36Z","modified":"2026-02-04T04:26:02.290757Z","updated_at":"2026-11-02T15:53:46.44301Z"}]}}