{"id":"CVE-2024-37408","aliases":["EUVD-2024-36642","GHSA-268h-82rc-5x3h"],"status":"disputed","title":"fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be...","description":"fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by \"auth sufficient pam_fprintd.so\" for Sudo. NOTE: the supplier disputes this because they believe issue resolution would involve modifying the PAM configuration to restrict pam_fprintd.so to front-ends that implement a proper attention mechanism, not modifying pam_fprintd.so or fprintd.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00273,"percentile":0.1983,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2024-06-08T00:00:00Z","modified":"2026-10-28T02:30:57Z","products":[{"vendor":"libfprint","product":"fprintd"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2024/05/30/3","tags":["x_transferred","web"]},{"url":"https://lists.freedesktop.org/archives/fprint/2024-May/001231.html","tags":["x_transferred","web"]},{"url":"https://gitlab.freedesktop.org/libfprint/fprintd/-/releases","tags":["x_transferred","web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/06/13/2","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/13/3","tags":["mailing-list","x_transferred","article"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/14/1","tags":["mailing-list","x_transferred","article"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/14/2","tags":["mailing-list","x_transferred","article"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/14/3","tags":["mailing-list","x_transferred","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37408","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-268h-82rc-5x3h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37408.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-37408","description":"fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by \"auth sufficient pam_fprintd.so\" for Sudo. NOTE: the supplier disputes this because they believe issue resolution would involve modifying the PAM configuration to restrict pam_fprintd.so to front-ends that implement a proper attention mechanism, not modifying pam_fprintd.so or fprintd.","status":"disputed","published":"2024-06-08T00:00:00Z","modified":"2024-09-06T18:33:28.803Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:00.929382Z"}],"euvd":[{"id":"EUVD-2024-36642","description":"fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by \"auth sufficient pam_fprintd.so\" for Sudo. NOTE: the supplier disputes this because they believe issue resolution would involve modifying the PAM configuration to restrict pam_fprintd.so to front-ends that implement a proper attention mechanism, not modifying pam_fprintd.so or fprintd.","status":"published","published":"2024-06-08T00:00:00Z","modified":"2024-09-06T18:33:28Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:01.652315Z"}],"ghsa":[{"id":"GHSA-268h-82rc-5x3h","title":"fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be...","description":"fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by \"auth sufficient pam_fprintd.so\" for Sudo.","status":"published","published":"2024-06-08T15:31:18Z","modified":"2024-09-06T21:33:29Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:58:11.86243Z"}],"nvd":[{"id":"CVE-2024-37408","description":"fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by \"auth sufficient pam_fprintd.so\" for Sudo. NOTE: the supplier disputes this because they believe issue resolution would involve modifying the PAM configuration to restrict pam_fprintd.so to front-ends that implement a proper attention mechanism, not modifying pam_fprintd.so or fprintd.","status":"disputed","published":"2024-06-08T14:15:11.307Z","modified":"2026-06-17T07:38:18.857Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:10:04.111836Z"}],"osv":[{"id":"CVE-2024-37408","description":"fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by \"auth sufficient pam_fprintd.so\" for Sudo. NOTE: the supplier disputes this because they believe issue resolution would involve modifying the PAM configuration to restrict pam_fprintd.so to front-ends that implement a proper attention mechanism, not modifying pam_fprintd.so or fprintd.","status":"published","published":"2024-06-08T00:00:00Z","modified":"2026-10-28T02:30:57.555362061Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:41.133403Z"}]}}