medium6.7
CVE-2025-24531
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before…
Impact
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.
Affected products
| Product | Affected versions |
|---|---|
| OpenSC Pam Pkcs11 | before 0.6.13 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/OpenSC/pam_pkcs11/releases
- https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-7mf6-rg36-qgch
- https://www.openwall.com/lists/oss-security/2025/02/06/3
- http://www.openwall.com/lists/oss-security/2025/02/06/3
- http://www.openwall.com/lists/oss-security/2025/02/06/7