[manjaro-security] [ASA-202012-13] pam: authentication bypass
foxboron at archlinux.org
Thu Dec 17 20:21:53 CET 2020
Arch Linux Security Advisory ASA-202012-13
Date : 2020-12-09
CVE-ID : CVE-2020-27780
Package : pam
Type : authentication bypass
Remote : No
Link : https://security.archlinux.org/AVG-1297
The package pam before version 1.5.0-2 is vulnerable to authentication
Upgrade to 1.5.0-2.
# pacman -Syu "pam>=1.5.0-2"
The problem has been fixed upstream but no release is available yet.
The issue can be mitigated by setting a non-empty password for the root
An authentication bypass issue was found in pam 1.5.0. Nonexistent
users could authenticate if the root password was empty.
In some unusual configurations, a remote user might be able to bypass
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the manjaro-security