CVE-2017-12197
Publication date 18 January 2018
Last updated 17 July 2025
Ubuntu priority
Description
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libpam4j | ||
| 16.04 LTS xenial |
Fixed 1.4-2+deb8u1build0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 1.4-2+deb8u1build0.14.04.1
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.5 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |