Summary
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.
Security Fix(es):
* pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass (CVE-2024-10963)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | pam | 1.5.1-22.el9_5 |
| AlmaLinux · 9 | pam-devel | 1.5.1-22.el9_5 |
| AlmaLinux · 9 | pam-docs | 1.5.1-22.el9_5 |
Vulnerabilities 1
-
High 7.4
Pam: improper hostname interpretation in pam_access leads to access control bypass
A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a …