OESA-2022-1646

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1646
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2022-1646.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2022-1646
Upstream
Published
2022-05-11T11:03:46Z
Modified
2025-09-03T06:17:03.616598Z
Summary
selinux-policy security update
Details

SELinux Base package for SELinux Reference Policy - modular.

Security Fix(es):

An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option (the default when configured by the authselect tool), and that file cannot be read, the second factor is disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.(CVE-2020-24612)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / selinux-policy

Package

Name
selinux-policy
Purl
pkg:rpm/openEuler/selinux-policy&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.14.2-77.oe1

Ecosystem specific 

{
    "noarch": [
        "selinux-policy-3.14.2-77.oe1.noarch.rpm",
        "selinux-policy-devel-3.14.2-77.oe1.noarch.rpm",
        "selinux-policy-help-3.14.2-77.oe1.noarch.rpm",
        "selinux-policy-minimum-3.14.2-77.oe1.noarch.rpm",
        "selinux-policy-mls-3.14.2-77.oe1.noarch.rpm",
        "selinux-policy-sandbox-3.14.2-77.oe1.noarch.rpm",
        "selinux-policy-targeted-3.14.2-77.oe1.noarch.rpm"
    ],
    "src": [
        "selinux-policy-3.14.2-77.oe1.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2022-1646.json"

openEuler:20.03-LTS-SP3 / selinux-policy

Package

Name
selinux-policy
Purl
pkg:rpm/openEuler/selinux-policy&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.14.2-76.oe1

Ecosystem specific 

{
    "noarch": [
        "selinux-policy-3.14.2-76.oe1.noarch.rpm",
        "selinux-policy-devel-3.14.2-76.oe1.noarch.rpm",
        "selinux-policy-help-3.14.2-76.oe1.noarch.rpm",
        "selinux-policy-minimum-3.14.2-76.oe1.noarch.rpm",
        "selinux-policy-mls-3.14.2-76.oe1.noarch.rpm",
        "selinux-policy-sandbox-3.14.2-76.oe1.noarch.rpm",
        "selinux-policy-targeted-3.14.2-76.oe1.noarch.rpm"
    ],
    "src": [
        "selinux-policy-3.14.2-76.oe1.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2022-1646.json"