{
  "cveId": "CVE-2025-1390",
  "url": "https://patchblox.com/security/cve/CVE-2025-1390",
  "summary": "CVE-2025-1390 is fixed in 8 products on 1 platform, first by DEBIAN-CVE-2025-1390, released February 18, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libcap2: The PAM module pam_cap.so of libcap configuration supports group namesstarting with \u201C@\u201D, during actual parsing, confi...",
  "description": "The PAM module pam_cap.so of libcap configuration supports group namesstarting with \u201C@\u201D, during actual parsing, configurations not starting with\u201C@\u201D are incorrectly recognized as group names. This may result innonintended users being granted an inherited capability set, potentiallyleading to security risks. Attackers can exploit this vulnerability toachieve local privilege escalation on systems where/etc/security/capability.conf is used to configure user inheritedprivileges by constructing specific usernames.",
  "published": "2025-02-18T03:15:10Z",
  "severity": "Medium",
  "cvss": 6.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
  "epss": 0.00176,
  "epssPercentile": 0.07167,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libcap",
      "release": "amzn 2023",
      "fixedVersion": "2.48-2.amzn2023.0.4",
      "fix": "ALAS2023-2025-897",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-897",
      "released": "2025-03-13T04:48:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.48-2.amzn2023.0.4",
      "fix": "ALAS2023-2025-897",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-897",
      "released": "2025-03-13T04:48:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "2.48-2.amzn2023.0.4",
      "fix": "ALAS2023-2025-897",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-897",
      "released": "2025-03-13T04:48:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap-devel",
      "release": "amzn 2023",
      "fixedVersion": "2.48-2.amzn2023.0.4",
      "fix": "ALAS2023-2025-897",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-897",
      "released": "2025-03-13T04:48:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap-static",
      "release": "amzn 2023",
      "fixedVersion": "2.48-2.amzn2023.0.4",
      "fix": "ALAS2023-2025-897",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-897",
      "released": "2025-03-13T04:48:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap2",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1:2.66-4\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2025-1390",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-1390",
      "released": "2025-02-18T03:15:10Z"
    },
    {
      "platform": "linux",
      "product": "libcap2",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:2.73-4",
      "fix": "DEBIAN-CVE-2025-1390",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-1390",
      "released": "2025-02-18T03:15:10Z"
    },
    {
      "platform": "linux",
      "product": "libcap2",
      "release": "Debian 14",
      "fixedVersion": "1:2.73-4",
      "fix": "DEBIAN-CVE-2025-1390",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-1390",
      "released": "2025-02-18T03:15:10Z"
    },
    {
      "platform": "linux",
      "product": "libcap2",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:2.32-1ubuntu0.2",
      "fix": "libcap2 1:2.32-1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libcap2-1-2.32-1ubuntu0.2",
      "released": "2025-02-19T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap2",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:2.44-1ubuntu0.22.04.2",
      "fix": "libcap2 1:2.44-1ubuntu0.22.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libcap2-1-2.44-1ubuntu0.22.04.2",
      "released": "2025-02-19T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap2",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1:2.66-5ubuntu2.2",
      "fix": "libcap2 1:2.66-5ubuntu2.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libcap2-1-2.66-5ubuntu2.2",
      "released": "2025-02-19T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap2",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1:2.66-5ubuntu3.1",
      "fix": "libcap2 1:2.66-5ubuntu3.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libcap2-1-2.66-5ubuntu3.1",
      "released": "2025-02-20T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap2-bin",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:2.32-1ubuntu0.2",
      "fix": "libcap2-bin 1:2.32-1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libcap2-bin-1-2.32-1ubuntu0.2",
      "released": "2025-02-19T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap2-bin",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:2.44-1ubuntu0.22.04.2",
      "fix": "libcap2-bin 1:2.44-1ubuntu0.22.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libcap2-bin-1-2.44-1ubuntu0.22.04.2",
      "released": "2025-02-19T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap2-bin",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1:2.66-5ubuntu2.2",
      "fix": "libcap2-bin 1:2.66-5ubuntu2.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libcap2-bin-1-2.66-5ubuntu2.2",
      "released": "2025-02-19T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libcap2-bin",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1:2.66-5ubuntu3.1",
      "fix": "libcap2-bin 1:2.66-5ubuntu3.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libcap2-bin-1-2.66-5ubuntu3.1",
      "released": "2025-02-20T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libpam-cap",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:2.32-1ubuntu0.2",
      "fix": "libpam-cap 1:2.32-1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libpam-cap-1-2.32-1ubuntu0.2",
      "released": "2025-02-19T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libpam-cap",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:2.44-1ubuntu0.22.04.2",
      "fix": "libpam-cap 1:2.44-1ubuntu0.22.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libpam-cap-1-2.44-1ubuntu0.22.04.2",
      "released": "2025-02-19T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libpam-cap",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1:2.66-5ubuntu2.2",
      "fix": "libpam-cap 1:2.66-5ubuntu2.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libpam-cap-1-2.66-5ubuntu2.2",
      "released": "2025-02-19T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libpam-cap",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1:2.66-5ubuntu3.1",
      "fix": "libpam-cap 1:2.66-5ubuntu3.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libpam-cap-1-2.66-5ubuntu3.1",
      "released": "2025-02-20T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}