p PatchFirst

CVE-2024-47191

CVE-2024-47191

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink.

CVSS 7.1 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • oath-toolkit Debian:12

    Versions
    • 2.6.7-3.1
    Affected ranges
    • ECOSYSTEM: < 2.6.7-3.1+deb12u1

    Update to 2.6.7-3.1+deb12u1

  • oath-toolkit Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.6.12-1

    Update to 2.6.12-1

  • oath-toolkit Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.6.12-1

    Update to 2.6.12-1

  • oath-toolkit Ubuntu:22.04:LTS

    Versions
    • 2.6.6-3
    • 2.6.6-3build1
    • 2.6.7-3
    • 2.6.7-3build1
    Affected ranges
    • ECOSYSTEM: < 2.6.7-3ubuntu0.1

    Update to 2.6.7-3ubuntu0.1

  • oath-toolkit Ubuntu:24.04:LTS

    Versions
    • 2.6.9-1
    • 2.6.10-1
    • 2.6.11-1
    • 2.6.11-2
    • 2.6.11-2.1build1
    • 2.6.11-2.1build2
    • 2.6.11-2.1build3
    Affected ranges
    • ECOSYSTEM: < 2.6.11-2.1ubuntu0.1

    Update to 2.6.11-2.1ubuntu0.1

  • oath-toolkit Ubuntu:25.10

    Versions
    • 2.6.11-3ubuntu1
    • 2.6.11-3ubuntu3
    • 2.6.12-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →