CVE-2017-12197 Improper Input Validation in libpam4j
MediumCVSS 6.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.kohsuke/libpam4j(Maven) | < 1.10 | 1.10 |
| org.kohsuke/libpam4j(Maven) | = 1.5 | No fix listed |
| org.kohsuke/libpam4j(Maven) | = 1.6 | No fix listed |
| org.kohsuke/libpam4j(Maven) | = 1.7 | No fix listed |
| org.kohsuke/libpam4j(Maven) | = 1.8 | No fix listed |
| org.kohsuke/libpam4j(Maven) | = 1.9 | No fix listed |
| libpam4j project libpam4j | <= 1.8 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat libpam4j | = up to and including 1.8 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2017:2904 third-party-advisory vendor-advisory
- RHSA-2017:2905 third-party-advisory vendor-advisory
- RHSA-2017:2906 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- [debian-lts-announce] 20171107 [SECURITY] [DLA 1165-1] libpam4j security update mailing-list third-party-advisory
- DSA-4025 third-party-advisory vendor-advisory
- github.com
- github.com patch
- github.com
- github.com product