Numeric Errors Affecting pam_ssh_agent_auth package, versions <0:0.9-81.17.amzn1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-AMZN201803-PAMSSHAGENTAUTH-1664848
- published 27 Sep 2021
- disclosed 5 Apr 2012
Introduced: 5 Apr 2012
CVE-2011-5000 Open this link in a new tabHow to fix?
Upgrade Amazon-Linux:2018.03 pam_ssh_agent_auth to version 0:0.9-81.17.amzn1 or higher.
This issue was patched in ALAS-2012-99.
NVD Description
Note: Versions mentioned in the description apply only to the upstream pam_ssh_agent_auth package and not the pam_ssh_agent_auth package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2018.03 relevant fixed versions and status.
The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which this issue is relevant.