CVE catalog

CVE-2017-12197

UBUNTU-CVE-2017-12197

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.51% · Oct 25, 2026

It was found that libpam4j did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information. libpam4j: Account check bypass The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibpam4j81.4-2vulnerable
Debianlibpam4j81.4-2+deb8u1fixed
Debianlibpam4j91.4-2vulnerable
Debianlibpam4j91.4-2+deb9u1fixed
Debianlibpam4j71.4-2vulnerable
Debianlibpam4j71.4-2+deb7u1fixed
Ubuntulibpam4j14.041.4-2vulnerable
Ubuntulibpam4j14.041.4-2+deb8u1build0.14.04.1fixed
Ubuntulibpam4j16.041.4-2vulnerable
Ubuntulibpam4j16.041.4-2+deb8u1build0.16.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibpam4jdeb81.4-2+deb8u1Not reportedDSA-4025-1Not reported
Debianlibpam4jdeb91.4-2+deb9u1Not reportedDSA-4025-1Not reported
Debianlibpam4jdeb71.4-2+deb7u1Not reportedDLA-1165-1Not reported
Ubuntulibpam4jdeb14.041.4-2+deb8u1build0.14.04.1Not reportedUBUNTU-CVE-2017-12197Not reported
Ubuntulibpam4jdeb16.041.4-2+deb8u1build0.16.04.1Not reportedUBUNTU-CVE-2017-12197Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]