Hi Nicolas, On Sat, Jul 13, 2019 at 02:40:28PM +0200, Nicolas Braud-Santoni wrote: > Package: libpam-u2f > Version: 1.0.7-1 > Severity: important > Tags: security > Control: not-found -1 1.0.8-1 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > Yubico issued a new release of pam-u2f that fixes 2 security issues, both > locally-exploitable information disclosures (and write-access to debug log): > > - - CVE-2019-12209 insecure debug file handling > > pam-u2f attempts parsing of the configured authfile (default > ~/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and > does > not properly verify that the path lacks symlinks pointing to other files on > the system owned by root. > If the debug option is enabled in the PAM configuration, part of the file > contents of a symlink target will be logged, possibly revealing sensitive > information.
This was filled as #930021 ;-) > - - CVE-2019-12210 debug file descriptor leak > > When pam-u2f is configured with debug and a custom debug log file is set > using > debug_file, that file descriptor is not closed when a new process is > spawned. > This leads to the file descriptor being inherited into the child process; > the > child process can then read from and write to it. This can leak sensitive > information and also, if written to, be used to fill the disk or plant > misinformation. This one as #930023. > Should I make a version of the package for buster-security? > FWIW, those issues aren't exploitable in the default configuration, > but I'd rather not leave them at all. The issues do not really warrant a DSA. But they can be fixed via an upcoming point release for both buster and stretch. Regards, Salvatore
