#1106087 libpam-u2f: missing functionality of nouserok flag

Package:
libpam-u2f
Source:
libpam-u2f
Description:
universal 2nd factor (U2F) PAM module
Submitter:
Janek Filus
Date:
2025-05-19 14:09:02 UTC
Severity:
normal
#1106087#5
Date:
2025-05-19 14:06:36 UTC
From:
To:
Dear Maintainer,

While fixing CVE-2025-23013, it seems that the functionality of the 'nouserok'
flag in the code has been deleted:

https://salsa.debian.org/auth-team/pam-u2f/-/commit/8c0c9867ce83325712e801f635505138840559a6#0ccf1a1953f68dff217424f8b4e807455b2c0387_0_52

Expected behaviour is that the nouserok flag still works in the Debian/bookworm libpam-u2f
package version.
In upstream Debian/Trixie libpam-u2f:1.3.2-1, the functionality of the nouserok
flag works.

A possible pam-configuration that we currently use looks like this.
-- >8 --
user@host:~$ cat /usr/share/pam-configs/dummy-u2f-pam-config-nouserok
Name: u2f authentication using pam-u2f (nouserok)
Default: no
Priority: 384
Auth-Type: Additional
Auth:
    required        pam_u2f.so authfile=/etc/u2f_mappings nouserok
Auth-Initial:
    required        pam_u2f.so authfile=/etc/u2f_mappings nouserok
-- >8 --



Best,
 Janek