{"id":"CVE-2025-1390","aliases":["AZL-56916","AZL-57034","BELL-CVE-2025-1390","DEBIAN-CVE-2025-1390","DLA-4092-1","EUVD-2025-4857","GHSA-cq92-4vj3-mcq8","MGASA-2025-0082","OESA-2025-1243","UBUNTU-CVE-2025-1390","USN-7287-1"],"status":"published","title":"pam_cap: Fix potential configuration parsing error","description":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00176,"percentile":0.07159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2025-02-18T02:34:44Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"libcap","fixed_in":["2.60-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libcap","fixed_in":["2.69-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libcap","fixed_in":["2.76-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libcap2","fixed_in":["1:2.66-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcap2","fixed_in":["1:2.73-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcap2","fixed_in":["1:2.73-4"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libcap","fixed_in":["2.52-5.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libcap","fixed_in":["2.69-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libcap","fixed_in":["2.69-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libcap","fixed_in":["2.32-8.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"libcap","fixed_in":["2.61-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libcap","fixed_in":["2.61-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libcap2","fixed_in":["1:2.32-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libcap2","fixed_in":["1:2.44-1ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libcap2","fixed_in":["1:2.66-5ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"libcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.60-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.69-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.66-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.66-r0"},{"fixed":"2.76-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.66-4+deb12u1"}]}],"versions":["1:2.66-4"]},{"source":"osv","ecosystem":"Debian:13","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.73-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.73-4"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.44-1+deb11u1"}]}],"versions":["1:2.44-1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"libcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52-5.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.69-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.69-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-8.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.61-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.61-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.22-1.2ubuntu2","1:2.24-0ubuntu1","1:2.24-0ubuntu2","1:2.24-0ubuntu2+esm1","1:2.24-0ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.24-9","1:2.24-12","1:2.24-12ubuntu0.1~esm1","1:2.24-12ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.25-1.1","1:2.25-1.2","1:2.25-1.2ubuntu0.1~esm1","1:2.25-1.2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.32-1ubuntu0.2"}]}],"versions":["1:2.25-2","1:2.27-1","1:2.32-1","1:2.32-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.44-1ubuntu0.22.04.2"}]}],"versions":["1:2.44-1build1","1:2.44-1build2","1:2.44-1build3","1:2.44-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.66-5ubuntu2.2"}]}],"versions":["1:2.66-4ubuntu1","1:2.66-5ubuntu1","1:2.66-5ubuntu2","1:2.66-5ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.32-1ubuntu0.2"}]}],"versions":["1:2.25-2","1:2.27-1","1:2.32-1","1:2.32-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.44-1ubuntu0.22.04.2"}]}],"versions":["1:2.44-1build1","1:2.44-1build2","1:2.44-1build3","1:2.44-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.66-5ubuntu2.2"}]}],"versions":["1:2.66-4ubuntu1","1:2.66-5ubuntu1","1:2.66-5ubuntu2","1:2.66-5ubuntu2.1"]}],"products":[{"vendor":"openanolis","product":"anolis os"},{"vendor":"siemens","product":"ruggedcom rst2428p"},{"vendor":"siemens","product":"scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family"},{"vendor":"siemens","product":"scalance xch328"},{"vendor":"siemens","product":"scalance xcm324"},{"vendor":"siemens","product":"scalance xcm328"},{"vendor":"siemens","product":"scalance xcm332"},{"vendor":"siemens","product":"scalance xrh334 (24 v dc, 8xfo, cc)"},{"vendor":"siemens","product":"scalance xrm334 (230 v ac, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (230 v ac, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (230v ac, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"scalance xrm334 (24 v dc, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (24 v dc, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (24v dc, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"scalance xrm334 (2x230 v ac, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (2x230 v ac, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (2x230v ac, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://bugzilla.openanolis.cn/show_bug.cgi?id=18804","tags":["report"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-089022.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1390","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cq92-4vj3-mcq8"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-1390","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-1390","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0082.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34048","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7287-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1243","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-1390","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-1390","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-1390","title":"pam_cap: Fix potential configuration parsing error","description":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.","status":"published","published":"2025-02-18T02:34:44.846Z","modified":"2026-10-15T01:01:58.054Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:32:49.824855Z"}],"euvd":[{"id":"EUVD-2025-4857","description":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.","status":"published","published":"2025-02-18T02:34:44Z","modified":"2026-10-15T01:01:58Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:08.661475Z"}],"ghsa":[{"id":"GHSA-cq92-4vj3-mcq8","title":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during...","description":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.","status":"published","published":"2025-02-18T03:31:05Z","modified":"2026-10-15T03:34:30Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:13:31.301503Z"}],"nvd":[{"id":"CVE-2025-1390","description":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.","status":"published","published":"2025-02-18T03:15:10.447Z","modified":"2026-10-15T02:17:24.487Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:10:51.445921Z"}],"osv":[{"id":"BELL-CVE-2025-1390","status":"published","published":"2025-02-19T05:57:01.194785Z","modified":"2026-04-23T07:15:33.72091Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"DEBIAN-CVE-2025-1390","description":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.","status":"published","published":"2025-02-18T03:15:10.447Z","modified":"2026-10-15T09:47:40.489836987Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"OESA-2025-1243","title":"libcap security update","description":"This is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.\r\n\r\nSecurity Fix(es):\n\nThe PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.(CVE-2025-1390)","status":"published","published":"2025-03-07T11:08:20Z","modified":"2026-08-18T01:17:49.141503453Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-1390","description":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.","status":"published","published":"2025-02-20T00:00:00Z","modified":"2026-06-23T22:00:07.953148979Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"AZL-56916","title":"CVE-2025-1390 affecting package libcap for versions less than 2.60-3","description":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.","status":"published","published":"2025-02-18T03:15:10Z","modified":"2026-04-21T04:36:49.304431Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57034","title":"CVE-2025-1390 affecting package libcap for versions less than 2.69-2","description":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.","status":"published","published":"2025-02-18T03:15:10Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"CVE-2025-1390","description":"The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.","status":"published","published":"2025-02-18T03:15:10Z","modified":"2026-04-16T04:43:12.079754049Z","updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DLA-4092-1","title":"libcap2 - security update","status":"published","published":"2025-03-26T00:00:00Z","modified":"2026-03-09T01:19:22.06574Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0082","title":"Updated libcap packages fix security vulnerability","description":"pam_cap: Fix potential configuration parsing error. (CVE-2025-1390)\n","status":"published","published":"2025-02-26T20:10:46Z","modified":"2026-04-16T04:43:33.843327613Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"USN-7287-1","title":"libcap2 vulnerability","description":"Tianjia Zhang discovered the libcap2 PAM module pam_cap incorrectly\nhandled parsing group names in the configuration file. This could result in\ncertain users being granted capabilities, contrary to expectations.\n","status":"published","published":"2025-02-24T12:32:46Z","modified":"2026-04-27T17:45:02.692736Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}