CVE catalog
CVE-2021-31924
pam-u2f: CVE-2021-31924
- Severity
- High · CVSS 7.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.33% · Oct 25, 2026
Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | pam-u2f | sid | 1.4.0-3 | fixed |
| Debian | pam-u2f | forky | 1.4.0-3 | fixed |
| Debian | pam-u2f | trixie | 1.4.0-1 | fixed |
| Debian | pam-u2f | bookworm | 1.1.0-1.1+deb12u1 | fixed |
| Debian | pam-u2f | bookworm-security | 1.1.0-1.1+deb12u1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | pam-u2f | source | sid | 1.1.0-1.1 | not yet assigned | Not reported | [987545] |
| Debian | pam-u2f | source | forky | 1.1.0-1.1 | not yet assigned | Not reported | [987545] |
| Debian | pam-u2f | source | trixie | 1.1.0-1.1 | not yet assigned | Not reported | [987545] |
| Debian | pam-u2f | source | bookworm | 1.1.0-1.1 | not yet assigned | Not reported | [987545] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libpam-u2f]Fixed
Source package: [pam-u2f]
Details (4)
1.1.0-1.1+deb12u1· amd64 · bookwormFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12
1.1.0-1.1+deb12u1· arm64 · bookwormFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12
1.1.0-1.1+deb12u1· amd64 · bookworm-securityFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12
1.1.0-1.1+deb12u1· arm64 · bookworm-securityFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12
- [pamu2fcfg]Fixed
Source package: [pam-u2f]
Details (4)
1.1.0-1.1+deb12u1· amd64 · bookwormFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12
1.1.0-1.1+deb12u1· arm64 · bookwormFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12
1.1.0-1.1+deb12u1· amd64 · bookworm-securityFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12
1.1.0-1.1+deb12u1· arm64 · bookworm-securityFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · bookworm; dsa · pam-u2f · debian · 12
[Debian 13 (Trixie)]
- [libpam-u2f]Fixed
Source package: [pam-u2f]
Details (2)
1.4.0-1· amd64 · trixieFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · 13
1.4.0-1· arm64 · trixieFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · 13
- [pamu2fcfg]Fixed
Source package: [pam-u2f]
Details (2)
1.4.0-1· amd64 · trixieFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · 13
1.4.0-1· arm64 · trixieFixed · Fixed:
1.1.0-1.1dsa · pam-u2f · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11145-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-31924]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2021-31924]
- [https://security-tracker.debian.org/tracker/CVE-2021-31924]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]