CVE-2019-12210 log

Source
Severity Medium
Remote No
Type Information disclosure
Description
A file descriptor leak has been found in pam-u2f before 1.8.0. If the `debug` and `debug_file` options are set then the opened debug file will be inherited to the successfully authenticated user's process. Therefore this user can write further information to it, possibly filling up a privileged file system or manipulating the information found in the debug file.
This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.
Group Package Affected Fixed Severity Status Ticket
AVG-973 pam-u2f 1.0.7-2 1.0.8-2 Medium Fixed
Date Advisory Group Package Severity Type
07 Jun 2019 ASA-201906-5 AVG-973 pam-u2f Medium information disclosure
References
https://seclists.org/oss-sec/2019/q2/149
https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62