This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-9275 →

DEBIAN-CVE-2018-9275

In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth map...

Original description

The description as published by the source.

In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file, which can lead to information disclosure (serial number of a device) and/or DoS (reaching the maximum number of file descriptors).

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 yubico-pam

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-1"}]}]

Debian:13 yubico-pam

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-1"}]}]

Debian:14 yubico-pam

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-1"}]}]

References

advisory security-tracker.debian.org