CVE-2019-19521

CRITICAL

OpenBSD 6.6 - Authentication Bypass via -schallenge Username

Title source: llm
STIX 2.1

Description

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c and gen/authenticate.c in libc (and login/login.c and xenocara/app/xenodm/greeter/verify.c).

References (7)

Core 7
Core References
Exploit, Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2019/12/04/5
Vendor Advisory x_refsource_misc
https://www.openbsd.org/errata66.html
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/12/04/6
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/12/04/5
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Dec/8
Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/Dec/14

Scores

CVSS v3 9.8
EPSS 0.0040
EPSS Percentile 60.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-287
Status published
Products (1)
openbsd/openbsd 6.6
Published Dec 05, 2019
Tracked Since Feb 18, 2026