CVE-2017-12197

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-18 · updated 2026-06-17
Weakness: CWE-863

Description

It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.

Affected products

Debian Linux: 7.0, 8.0, 9.0
Libpam4J Project Libpam4J: through 1.8
Red Hat Enterprise Linux: 6.0

References

https://access.redhat.com/errata/RHSA-2017:2904
https://access.redhat.com/errata/RHSA-2017:2905
https://access.redhat.com/errata/RHSA-2017:2906
https://bugzilla.redhat.com/show_bug.cgi?id=1503103
https://lists.debian.org/debian-lts-announce/2017/11/msg00008.html
https://www.debian.org/security/2017/dsa-4025
https://access.redhat.com/errata/RHSA-2017:2904
https://access.redhat.com/errata/RHSA-2017:2905
https://access.redhat.com/errata/RHSA-2017:2906
https://bugzilla.redhat.com/show_bug.cgi?id=1503103
https://lists.debian.org/debian-lts-announce/2017/11/msg00008.html
https://www.debian.org/security/2017/dsa-4025

Get alerted when CVE-2017-12197 or the next vulnerability affects your stack