Stay Secure with the Latest Linux Advisories

security advisorydebianauthentication

Debian 11 bullseye: DLA-4040-1 pam-u2f critical authentication bypass

Matthias Gerstner reported that pam-u2f, a PAM module which allows to use U2F (Universal 2nd Factor) devices in the PAM authentication stack, does not properly handle PAM_IGNORE return values, allowing to bypass the second factor or password-less login without inserting the proper . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4040-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Emilio Pozuelo Monfort February 03, 2025 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : pam-u2f Version : 1.1.0-1.1+deb11u1 CVE ID : CVE-2025-23013 Matthias Gerstner reported that pam-u2f, a PAM module which allows to use U2F (Universal 2nd Factor) devices in the PAM authentication stack, does not properly handle PAM_IGNORE return values, allowing to bypass the second factor or password-less login without inserting the proper device. For Debian 11 bullseye, this problem has been fixed in version 1.1.0-1.1+deb11u1. We recommend that you upgrade your pam-u2f packages. For the detailed security status of pam-u2f please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/pam-u2f Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . A security notice regarding pam-u2f in Debian LTS highlights vulnerabilities that allow bypassing security measures, calling for updates to bolster authentication safety.. pam-u2f, Debian LTS Security, Authentication Improvements, Second Factor Auth. . Severity: Critical. LinuxSecurity.com Team

Feb 03, 2025 •Critical Debian LTS