Summary
[1.5.1-22.0.1]
- pam_access: clean up the remote host matching code [Orabug: 36771903]
- pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534]
[1.5.1-22]
- pam_access: rework resolving of tokens as hostname.
Resolves: CVE-2024-10963 and RHEL-66245
[1.5.1-21]
- pam_unix: always run the helper to obtain shadow password file entries.
CVE-2024-10041. Resolves: RHEL-62880
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | pam | 0:1.5.1-22.0.1.el9_5 |
| Oracle Linux · 9 | pam-devel | 0:1.5.1-22.0.1.el9_5 |
| Oracle Linux · 9 | pam-docs | 0:1.5.1-22.0.1.el9_5 |
Vulnerabilities 1
-
High 7.4
Pam: improper hostname interpretation in pam_access leads to access control bypass
A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a …