CVE-2017-12197
Publication date 18 January 2018
Last updated 24 July 2024
Ubuntu priority
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libpam4j | ||
| 16.04 LTS xenial |
Fixed 1.4-2+deb8u1build0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 1.4-2+deb8u1build0.14.04.1
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.5 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |