CVE-2019-12210

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html
• http://www.openwall.com/lists/oss-security/2019/06/05/1Exploit, Mailing List, Third Party Advisory
• https://developers.yubico.com/pam-u2f/Release_Notes.htmlRelease Notes, Vendor Advisory
• https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html
• http://www.openwall.com/lists/oss-security/2019/06/05/1Exploit, Mailing List, Third Party Advisory
• https://developers.yubico.com/pam-u2f/Release_Notes.htmlRelease Notes, Vendor Advisory
• https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62Patch, Third Party Advisory

Published

Jun 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12205SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS…6.1
• CVE-2019-12206njs through 0.3.1, used in NGINX, has a heap-based buffer ov…
• CVE-2019-12207njs through 0.3.1, used in NGINX, has a heap-based buffer ov…
• CVE-2019-12208njs through 0.3.1, used in NGINX, has a heap-based buffer ov…
• CVE-2019-12209Yubico pam-u2f 1.0.7 attempts parsing of the configured auth…
• CVE-2019-1221A remote code execution vulnerability exists in the way that…7.5
• CVE-2019-12211When FreeImage 3.18.0 reads a tiff file, it will be handed t…7.5
• CVE-2019-12212When FreeImage 3.18.0 reads a special JXR file, the StreamCa…
• CVE-2019-12213When FreeImage 3.18.0 reads a special TIFF file, the TIFFRea…6.5
• CVE-2019-12214In FreeImage 3.18.0, an out-of-bounds access occurs because …
• CVE-2019-12215A full path disclosure vulnerability was discovered in Matom…
• CVE-2019-12216An issue was discovered in libSDL2.a in Simple DirectMedia L…6.5