Skip to content
OpenAdvisories
Unscored USN-4521-1 1 CVE

libpam-tacplus vulnerability

Published Sep 21, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that pam_tacplus did not properly manage shared secrets
if DEBUG loglevel and journald are used. A remote attacker could use this
issue to expose sensitive information.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS libpam-tacplus 1.3.8-2+deb8u1build0.16.04.1
Ubuntu · 18.04 LTS 18.04:LTS libpam-tacplus 1.3.8-2+deb8u1build0.18.04.1
Ubuntu · 20.04 LTS 20.04:LTS libpam-tacplus 1.3.8-2+deb8u1build0.20.04.1

Vulnerabilities 1

  • Unscored —
    CVE-2020-13881

    In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel…

    libpam-tacplus Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2020-13881