CVE-2024-10963

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

References

Affected packages

Debian:13 / pam

Package

Name: pam
Purl: pkg:deb/debian/pam?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.5.2-6

1.5.2-7

1.5.2-8

1.5.2-9

1.5.2-9.1

1.5.3-1

1.5.3-2

1.5.3-3

1.5.3-4

1.5.3-5

1.5.3-6

1.5.3-6+hurd.1

1.5.3-7

1.7.0-1

1.7.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}