CVE-2019-12209 Path traversal in n/a
An attacker can exploit symlink handling in the Yubico PAM U2F module to read sensitive root-owned files if debug logging is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12209?
CVE-2019-12209 is a high-severity path traversal vulnerability in n/a, published on 4 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
Weakness: CWE-59
Which versions are affected by CVE-2019-12209?
It affects 1 product.
Products include Yubico Pam-U2f.
How do I fix CVE-2019-12209?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-12209 being exploited?
There is no known exploitation of CVE-2019-12209 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2019-12209, GHSA-cf2r-5chq-jmm8.