CVE catalog

CVE-2018-9275

yubico-pam: CVE-2018-9275

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.42% · Oct 25, 2026

In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file, which can lead to information disclosure (serial number of a device) and/or DoS (reaching the maximum number of file descriptors).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianyubico-pamsid2.27-3fixed
Debianyubico-pamforky2.27-3fixed
Debianyubico-pamtrixie2.27-1fixed
Debianyubico-pambookworm2.26-1.1fixed
Opensusepam_yubicotumbleweed2.27-1.5fixed
Ubuntuyubico-pam16.042.19-1vulnerable
Ubuntuyubico-pam16.042.20-1vulnerable
Ubuntuyubico-pam18.042.23-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianyubico-pamsourcesid2.26-1not yet assignedNot reported[896491]
Debianyubico-pamsourceforky2.26-1not yet assignedNot reported[896491]
Debianyubico-pamsourcetrixie2.26-1not yet assignedNot reported[896491]
Debianyubico-pamsourcebookworm2.26-1not yet assignedNot reported[896491]
Opensusepam_yubicorpmtumbleweed2.27-1.5Not reportedOPENSUSE-SU-2024:11146-1Not reported

[Debian bug #896491]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libpam-yubico]Fixed

    Source package: [yubico-pam]

    Details (2)

    • 2.26-1.1+b1 · amd64 · bookworm

      Fixed · Fixed: 2.26-1

      dsa · yubico-pam · debian · bookworm; dsa · yubico-pam · debian · 12

    • 2.26-1.1+b1 · arm64 · bookworm

      Fixed · Fixed: 2.26-1

      dsa · yubico-pam · debian · bookworm; dsa · yubico-pam · debian · 12

[Debian 13 (Trixie)]

  • [libpam-yubico]Fixed

    Source package: [yubico-pam]

    Details (2)

    • 2.27-1+b1 · amd64 · trixie

      Fixed · Fixed: 2.26-1

      dsa · yubico-pam · debian · 13

    • 2.27-1+b2 · arm64 · trixie

      Fixed · Fixed: 2.26-1

      dsa · yubico-pam · debian · 13

[openSUSE Tumbleweed]

  • [pam_yubico]Fixed

    Source package: [pam_yubico]

    Details (1)

    • 2.27-2.21 · x86_64 · tumbleweed

      Fixed · Fixed: 2.27-1.5

      dsa · pam_yubico · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]