CVE-2017-12197 Improper Input Validation in libpam4j

Medium 6.5 Published 18 Jan 2018 Updated 5 Aug 2024

Attackers with valid passwords for disabled accounts can bypass authentication restrictions and access sensitive information via libpam4j.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-12197?

CVE-2017-12197 is a medium-severity authentication bypass vulnerability in Debian Debian Linux, published on 18 Jan 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.

Weakness: CWE-20, CWE-863

Which versions are affected by CVE-2017-12197?

2 open source packages ship an affected version, including org.kohsuke:libpam4j. It affects 3 products.

Package	Affected	Fixed in
`org.kohsuke:libpam4j` Maven	All versions	`1.10`
`org.kohsuke:libpam4j` Maven	All versions	`1.10`

Products include Debian Debian Linux, Libpam4j Project Libpam4j, Redhat Enterprise Linux.

How do I fix CVE-2017-12197?

Upgrade org.kohsuke:libpam4j to 1.10 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2017-12197 being exploited?

There is no known exploitation of CVE-2017-12197 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DLA-1165-1, DSA-4025-1, GHSA-x9rg-q5fx-fx66, MGASA-2018-0234, UBUNTU-CVE-2017-12197.