- -------------------------------------------------------------------------
Debian Security Advisory DSA-5853-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
January 29, 2025                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : pam-u2f
CVE ID         : CVE-2025-23013

Matthias Gerstner reported that pam-u2f, a PAM module which allows to
use U2F (Universal 2nd Factor) devices in the PAM authentication stack,
does not properly handle PAM_IGNORE return values, allowing to bypass
the second factor or password-less login without inserting the proper
device.

For the stable distribution (bookworm), this problem has been fixed in
version 1.1.0-1.1+deb12u1.

We recommend that you upgrade your pam-u2f packages.

For the detailed security status of pam-u2f please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/pam-u2f

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org