Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the     application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or     cryptographic signature verification to be bypassed, so an attacker would still need to physically possess     and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN     authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will     attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN     requirement is bypassed. (CVE-2021-31924)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the
    application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or
    cryptographic signature verification to be bypassed, so an attacker would still need to physically possess
    and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN
    authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will
    attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN
    requirement is bypassed. (CVE-2021-31924)

The remote host is affected by the vulnerability described in GLSA-202208-11 (Yubico pam-u2f: Local PIN Bypass vulnerability)

  - Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the     application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or     cryptographic signature verification to be bypassed, so an attacker would still need to physically possess     and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN     authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will     attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN     requirement is bypassed. (CVE-2021-31924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
259169	Linux Distros Unpatched Vulnerability : CVE-2021-31924	Nessus	Misc.	medium
406204	Alpine: multiple pam-u2f packages: security update to 1.1.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406204	Alpine: multiple pam-u2f packages: security update to 1.1.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
163987	GLSA-202208-11 : Yubico pam-u2f: Local PIN Bypass vulnerability	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2021-31924

medium

Tenable Plugins

medium

medium

medium

medium