In order to mitigate CVE-2025-23013, Yubico highly recommends ensuring your version of pam_u2f is at least 1.3.1.
I am running Zorin OS 18, fully updated, and noticed that the version of libpam-u2f currently available from the Ubuntu 24.04 (Noble) repositories is still 1.1.0.
My system reports:
$ dpkg -l | grep libpam-u2f
ii libpam-u2f 1.1.0-1.1+deb12u1build0.24.04.1 amd64
And:
$ apt policy libpam-u2f
libpam-u2f:
Installed: 1.1.0-1.1+deb12u1build0.24.04.1
Candidate: 1.1.0-1.1+deb12u1build0.24.04.1
500 http://au.archive.ubuntu.com/ubuntu noble-updates/universe amd64 Packages
500 http://security.ubuntu.com/ubuntu noble-security/universe amd64 Packages
According to the Ubuntu package repository, Noble currently provides libpam-u2f version 1.1.0-1.1+deb12u1build0.24.04.1.
Yubico, however, recommends pam_u2f 1.3.1 or later to mitigate CVE-2025-23013.
Since Zorin OS 18 is based on Ubuntu 24.04, it appears that the required newer version is not currently available through the standard Zorin/Ubuntu repositories.
Is there a plan for Zorin OS 18 to provide an updated libpam-u2f package (1.3.1 or later) to address this security recommendation?
I am specifically interested in whether Zorin intends to backport the relevant security fix to the current Zorin OS 18/Ubuntu Noble base, or whether an updated package is expected through the normal Zorin/Ubuntu update channels.
I would prefer not to manually install a newer pam_u2f package from outside the standard repositories, particularly because it is a PAM authentication module and an incorrect package/configuration could potentially affect system authentication.
Thanks.