CVE-2021-31924 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2021-31924 Interim 1 28 2026-03-05T05:19:23Z current 2021-05-30T14:50:28Z 2026-03-05T05:19:23Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2021-31924 Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15-ESPOS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Business Critical Linux 15 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Micro 6.0 SUSE Linux Micro 6.1 SUSE Manager Proxy 4.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Manager Retail Branch Server 4.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Manager Server 4.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 openSUSE Tumbleweed pam_u2f pam_u2f-1.1.1-1.3 pam_u2f-1.2.0-150400.2.4 pam_u2f-1.2.0-150600.10.8.1 pam_u2f-1.2.0-150600.8.3 pam_u2f-1.3.0-1.3 pam_u2f-1.3.0-slfo.1.1_1.2 pam_u2f-1.3.2-160000.2.2 pam_u2f-1.2.0-150400.2.4 as a component of SUSE Linux Enterprise Micro 5.3 pam_u2f-1.2.0-150400.2.4 as a component of SUSE Linux Enterprise Micro 5.4 pam_u2f-1.2.0-150400.2.4 as a component of SUSE Linux Enterprise Micro 5.5 pam_u2f-1.2.0-150400.2.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 pam_u2f-1.2.0-150400.2.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 pam_u2f-1.2.0-150600.8.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 pam_u2f-1.2.0-150600.10.8.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 pam_u2f-1.3.2-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 pam_u2f-1.3.0-1.3 as a component of SUSE Linux Micro 6.0 pam_u2f-1.3.0-slfo.1.1_1.2 as a component of SUSE Linux Micro 6.1 pam_u2f-1.1.1-1.3 as a component of openSUSE Tumbleweed pam_u2f as a component of SUSE CaaS Platform 4.0 pam_u2f as a component of SUSE Enterprise Storage 6 pam_u2f as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 pam_u2f as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS pam_u2f as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS pam_u2f as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 pam_u2f as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS pam_u2f as a component of SUSE Linux Enterprise Server 12 SP4-LTSS pam_u2f as a component of SUSE Linux Enterprise Server 12 SP5 pam_u2f as a component of SUSE Linux Enterprise Server 15 SP1-LTSS pam_u2f as a component of SUSE Linux Enterprise Server 15-ESPOS pam_u2f as a component of SUSE Linux Enterprise Server 15-LTSS pam_u2f as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP1 pam_u2f as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 pam_u2f as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 pam_u2f as a component of SUSE Linux Enterprise Server for SAP Applications 15 pam_u2f as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 pam_u2f as a component of SUSE Manager Proxy 4.0 pam_u2f as a component of SUSE Manager Retail Branch Server 4.0 pam_u2f as a component of SUSE Manager Server 4.0 pam_u2f as a component of SUSE OpenStack Cloud 9 pam_u2f as a component of SUSE OpenStack Cloud Crowbar 9 Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed. CVE-2021-31924 SUSE Linux Enterprise Micro 5.3:pam_u2f-1.2.0-150400.2.4 SUSE Linux Enterprise Micro 5.4:pam_u2f-1.2.0-150400.2.4 SUSE Linux Enterprise Micro 5.5:pam_u2f-1.2.0-150400.2.4 SUSE Linux Enterprise Module for Basesystem 15 SP4:pam_u2f-1.2.0-150400.2.4 SUSE Linux Enterprise Module for Basesystem 15 SP5:pam_u2f-1.2.0-150400.2.4 SUSE Linux Enterprise Module for Basesystem 15 SP6:pam_u2f-1.2.0-150600.8.3 SUSE Linux Enterprise Module for Basesystem 15 SP7:pam_u2f-1.2.0-150600.10.8.1 SUSE Linux Enterprise Server 16.0:pam_u2f-1.3.2-160000.2.2 SUSE Linux Micro 6.0:pam_u2f-1.3.0-1.3 SUSE Linux Micro 6.1:pam_u2f-1.3.0-slfo.1.1_1.2 openSUSE Tumbleweed:pam_u2f-1.1.1-1.3 SUSE CaaS Platform 4.0:pam_u2f SUSE Enterprise Storage 6:pam_u2f SUSE Linux Enterprise High Performance Computing 12 SP5:pam_u2f SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:pam_u2f SUSE Linux Enterprise High Performance Computing 15-LTSS:pam_u2f SUSE Linux Enterprise Module for Basesystem 15 SP2:pam_u2f SUSE Linux Enterprise Server 12 SP4-ESPOS:pam_u2f SUSE Linux Enterprise Server 12 SP4-LTSS:pam_u2f SUSE Linux Enterprise Server 12 SP5:pam_u2f SUSE Linux Enterprise Server 15 SP1-LTSS:pam_u2f SUSE Linux Enterprise Server 15-ESPOS:pam_u2f SUSE Linux Enterprise Server 15-LTSS:pam_u2f SUSE Linux Enterprise Server Business Critical Linux 15 SP1:pam_u2f SUSE Linux Enterprise Server for SAP Applications 12 SP4:pam_u2f SUSE Linux Enterprise Server for SAP Applications 12 SP5:pam_u2f SUSE Linux Enterprise Server for SAP Applications 15 SP1:pam_u2f SUSE Linux Enterprise Server for SAP Applications 15:pam_u2f SUSE Manager Proxy 4.0:pam_u2f SUSE Manager Retail Branch Server 4.0:pam_u2f SUSE Manager Server 4.0:pam_u2f SUSE OpenStack Cloud 9:pam_u2f SUSE OpenStack Cloud Crowbar 9:pam_u2f important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H