In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
[
{
"signature_version": "v1",
"source": "https://github.com/kravietz/pam_tacplus/commit/4a9852c31c2fd0c0e72fbb689a586aabcfb11cb0",
"id": "CVE-2020-13881-867c5ea3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50493327747601994803184485470296647249",
"243304694626446301564069739451306751369",
"295339740349483353043127422527639009217",
"197291942669024249787144713228464574358",
"49610643164185859089051875687174081841"
]
},
"target": {
"file": "support.c"
},
"deprecated": false,
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://github.com/kravietz/pam_tacplus/commit/4a9852c31c2fd0c0e72fbb689a586aabcfb11cb0",
"id": "CVE-2020-13881-be7678f1",
"digest": {
"function_hash": "67182900991507665679698129543518705166",
"length": 4144.0
},
"target": {
"file": "support.c",
"function": "_pam_parse"
},
"deprecated": false,
"signature_type": "Function"
}
]