CVE catalog

CVE-2019-12210

pam-u2f: CVE-2019-12210

[CVE catalog]

Severity
Medium · CVSS 6.8CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.06% · Oct 25, 2026

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpam-u2fsid1.4.0-3fixed
Debianpam-u2fforky1.4.0-3fixed
Debianpam-u2ftrixie1.4.0-1fixed
Debianpam-u2fbookworm1.1.0-1.1+deb12u1fixed
Debianpam-u2fbookworm-security1.1.0-1.1+deb12u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpam-u2fsourcesid1.0.8-1lowNot reported[930023]
Debianpam-u2fsourceforky1.0.8-1lowNot reported[930023]
Debianpam-u2fsourcetrixie1.0.8-1lowNot reported[930023]
Debianpam-u2fsourcebookworm1.0.8-1lowNot reported[930023]

[Debian bug #930023]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libpam-u2f]Fixed

    Source package: [pam-u2f]

    Details (4)

    • 1.1.0-1.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12

    • 1.1.0-1.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12

    • 1.1.0-1.1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12

    • 1.1.0-1.1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12

  • [pamu2fcfg]Fixed

    Source package: [pam-u2f]

    Details (4)

    • 1.1.0-1.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12

    • 1.1.0-1.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12

    • 1.1.0-1.1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12

    • 1.1.0-1.1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12

[Debian 13 (Trixie)]

  • [libpam-u2f]Fixed

    Source package: [pam-u2f]

    Details (2)

    • 1.4.0-1 · amd64 · trixie

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · 13

    • 1.4.0-1 · arm64 · trixie

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · 13

  • [pamu2fcfg]Fixed

    Source package: [pam-u2f]

    Details (2)

    • 1.4.0-1 · amd64 · trixie

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · 13

    • 1.4.0-1 · arm64 · trixie

      Fixed · Fixed: 1.0.8-1

      dsa · pam-u2f · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]