CVE-2020-24612

Katalog CVE

CVSS 4.7 · Medium EPSS 0,32%

Kerentanan Improper Authentication pada fedoraproject selinux-policy. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option (the default when configured by the authselect tool), and that file cannot be read, the second factor is disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.

Rincian

Terbit di NVD

24 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fedora-selinux/selinux-policy/commit/71e1989028802c7875d3436fd3966c587fa383fb patch · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=1860888 issue tracking · advisory pihak ketiga