GHSA-rqg8-xjp2-pg9w

LinOTP replay vulnerability with auto resynchronization enabled for TOTP token

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-12887

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	LinOTP	< 2.11.1	2.11.1

Details

As written in the advisory (Markdown source, shown as plain text).

LinOTP is prone to a replay attack with activated automatic resynchronization. This vulnerability may allow an attacker to successfully log in with OTP values recorded at a previous point in time. This attack is only possible if automatic resynchronization is enabled for the TOTP token type. The automatic resynchronization is deactivated by default. All other tokens are unaffected.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-12887 advisory
https://github.com/LinOTP/LinOTP/commit/6d28d93af59d2ce0d844a6a3282148064efc6ad8 web
https://github.com/LinOTP/LinOTP package
https://github.com/pypa/advisory-database/tree/main/vulns/linotp/PYSEC-2019-103.yaml web
https://linotp.org/linotp-hotfix-autoresync.html web
https://www.linotp.org/CVE-2019-12887.txt web