CVE-2024-37408

CVSS 7.3 HIGHEPSS 0.3%CWE-287

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

08 jun 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam_fprintd.so" for Sudo. NOTE: the supplier disputes this because they believe issue resolution would involve modifying the PAM configuration to restrict pam_fprintd.so to front-ends that implement a proper attention mechanism, not modifying pam_fprintd.so or fprintd.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Productos afectados

n/a · n/a

Referencias

https://gitlab.freedesktop.org/libfprint/fprintd/-/releases https://lists.freedesktop.org/archives/fprint/2024-May/001231.html https://www.openwall.com/lists/oss-security/2024/05/30/3 https://www.openwall.com/lists/oss-security/2024/06/13/2 http://www.openwall.com/lists/oss-security/2024/06/13/3 http://www.openwall.com/lists/oss-security/2024/06/14/1 http://www.openwall.com/lists/oss-security/2024/06/14/2 http://www.openwall.com/lists/oss-security/2024/06/14/3