Debian Package Tracker

general

source: pam-u2f (main)
version: 1.0.7-1
maintainer: Debian Authentication Maintainers [DMD]
uploaders: Alessio Di Mauro [DMD] – Nicolas Braud-Santoni [DMD] – Simon Josefsson [DMD]
arch: any
std-ver: 4.1.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 1.0.4-2
testing: 1.0.7-1
unstable: 1.0.7-1

versioned links

1.0.4-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.7-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libpam-u2f (1 bugs: 0, 1, 0, 0)
pamu2fcfg

action needed

A new upstream version is available: 1.0.8 high

A new upstream version 1.0.8 is available, you should consider packaging it.

Created: 2019-06-05 Last update: 2019-06-27 07:15

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2019-12209: Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
CVE-2019-12210: In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Please fix them.

Created: 2019-06-05 Last update: 2019-06-14 14:00

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

libpam-u2f could be marked Multi-Arch: same

Created: 2018-05-02 Last update: 2019-06-27 04:42

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.0.7-2, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 3a0f672f4a9bd03f17432359585264fd17acd96a
Author: Simon Josefsson <simon@josefsson.org>
Date:   Thu Mar 21 17:23:43 2019 +0100

    Drop myself from Uploader's.

commit 266896cde2ee60d4ce7ba0c6f212d83713b7e6ee
Author: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>
Date:   Tue May 29 14:35:04 2018 +0200

    Close bug #898519
    
    Confirmed in the upstream bug tracker to be solved in the newest version:
    
      https://github.com/Yubico/pam-u2f/issues/97#issuecomment-392485808

commit 4b2045d5aa06be9bd5cfd1f8d4a6fc55395f4fac
Author: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>
Date:   Tue May 29 14:20:20 2018 +0200

    Update debian/copyright

commit d4e184322081636abd38a32550a79f7b3e91e746
Author: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>
Date:   Sat May 26 18:52:45 2018 +0200

    Use the tracker.debian.org email address for the maintainers

commit d8440156b9bd1276e54499d5d2bca39619608aca
Author: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>
Date:   Sat May 26 18:18:39 2018 +0200

    Prepare upload v1.0.7-1

commit 927d08b6858f11e659d9ec734ae743eedfbf7bb8
Author: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>
Date:   Sat May 26 18:07:10 2018 +0200

    Switch to debhelper 11

commit 927e6454856c28cb3f03eb6e36f8c1e60ab6a01b
Author: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>
Date:   Sat May 26 18:04:52 2018 +0200

    Move the packaging repository to salsa.d.o

commit 77bcddb0810564309c9e1a4068bfd410fb3e319e
Merge: d7f0080 e15fd59
Author: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>
Date:   Sat May 26 17:03:31 2018 +0200

    Update upstream source from tag 'upstream/1.0.7'
    
    Update to upstream version '1.0.7'
    with Debian dir 7572cee1c7fd82d5c52c70ebd78d2b3919d66b5d

commit e15fd590c29f6685432075cb44647047475356e6
Author: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>
Date:   Sat May 26 17:03:30 2018 +0200

    New upstream version 1.0.7

Created: 2018-04-30 Last update: 2019-06-26 11:10

2 ignored security issues in buster low

There are 2 open security issues in buster.

2 issues skipped by the security teams:

CVE-2019-12209: Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
CVE-2019-12210: In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Please fix them.

Created: 2019-06-05 Last update: 2019-06-14 14:00

2 ignored security issues in stretch low

There are 2 open security issues in stretch.

2 issues skipped by the security teams:

CVE-2019-12209: Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
CVE-2019-12210: In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Please fix them.

Created: 2019-06-05 Last update: 2019-06-14 14:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.3.0 instead of 4.1.4).

Created: 2018-08-20 Last update: 2018-12-23 17:15

news

[rss feed]

[2018-07-04] pam-u2f 1.0.7-1 MIGRATED to testing (Debian testing watch)
[2018-06-28] Accepted pam-u2f 1.0.7-1 (source amd64) into unstable (Nicolas Braud-Santoni) (signed by: Jonathan Carter)
[2018-06-15] pam-u2f REMOVED from testing (Debian testing watch)
[2018-05-06] pam-u2f 1.0.6-1 MIGRATED to testing (Debian testing watch)
[2018-05-01] Accepted pam-u2f 1.0.6-1 (source amd64) into unstable (Nicolas Braud-Santoni) (signed by: Jonathan Carter)
[2016-12-20] Accepted pam-u2f 1.0.4-2~bpo8+1 (source amd64) into jessie-backports, jessie-backports (Luca Capello)
[2016-09-30] pam-u2f 1.0.4-2 MIGRATED to testing (Debian testing watch)
[2016-09-24] Accepted pam-u2f 1.0.4-2 (source) into unstable (Nicolas Braud-Santoni) (signed by: Evgeni Golov)
[2016-08-16] pam-u2f 1.0.4-1 MIGRATED to testing (Debian testing watch)
[2016-08-10] Accepted pam-u2f 1.0.4-1 (source) into unstable (Simon Josefsson)
[2016-08-09] pam-u2f 1.0.4-0.3 MIGRATED to testing (Debian testing watch)
[2016-08-02] Accepted pam-u2f 1.0.4-0.3 (source) into unstable (Nicolas Braud-Santoni) (signed by: Gianfranco Costamagna)
[2016-07-20] pam-u2f 1.0.4-0.2 MIGRATED to testing (Debian testing watch)
[2016-07-14] Accepted pam-u2f 1.0.4-0.2 (source) into unstable (Nicolas Braud-Santoni) (signed by: Gianfranco Costamagna)
[2016-07-14] Accepted pam-u2f 1.0.4-0.1 (source) into unstable (Nicolas Braud-Santoni) (signed by: Gianfranco Costamagna)
[2016-07-01] pam-u2f 1.0.3-1 MIGRATED to testing (Debian testing watch)
[2016-06-08] pam-u2f REMOVED from testing (Debian testing watch)
[2015-12-01] pam-u2f 1.0.3-1 MIGRATED to testing (Britney)
[2015-11-25] Accepted pam-u2f 1.0.3-1 (source) into unstable (Alessio Di Mauro) (signed by: Simon Josefsson)
[2015-10-14] pam-u2f 1.0.2-1 MIGRATED to testing (Britney)
[2015-10-08] Accepted pam-u2f 1.0.2-1 (source) into unstable (Alessio Di Mauro) (signed by: Simon Josefsson)
[2015-07-13] pam-u2f 1.0.1-1 MIGRATED to testing (Britney)
[2015-07-07] Accepted pam-u2f 1.0.1-1 (source) into unstable (Alessio Di Mauro) (signed by: Simon Josefsson)
[2015-06-08] pam-u2f 0.0.1-1 MIGRATED to testing (Britney)
[2015-05-28] Accepted pam-u2f 0.0.1-1 (source amd64) into unstable, unstable (Alessio Di Mauro) (signed by: Simon Josefsson)

bugs [bug history graph]

all: 5
RC: 0
I&N: 4
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.0.7-1
2 bugs