RSS   Vulnerabilities for 'Selinux-policy'   RSS

2020-08-24
 
CVE-2020-24612

CWE-287
 

 
An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option (the default when configured by the authselect tool), and that file cannot be read, the second factor is disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.

 

 >>> Vendor: Fedoraproject 19 Products
Fedora core
Coolkey
Commons
Fedora
SSSD
Dracut
389 directory server
Libnm-util
Networkmanager
Anaconda
Crypto-utils
Arm installer
Fedmsg
389 administration server
Python-fedora
Spin-kickstarts
Sectool
Selinux-policy
Fedora extra packages for enterprise linux


Copyright 2021, cxsecurity.com

 

Back to Top