Homepage

Improper Authentication The advisory has been revoked - it doesn't affect any version of package pam  (opens in a new tab)

Threat Intelligence

EPSS
0.78% (54th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-PAM-8352887
  • published8 Nov 2024
  • disclosed7 Nov 2024
Report a new vulnerability Found a mistake?

Introduced: 7 Nov 2024

CVE-2024-10963  (opens in a new tab)
CWE-287  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:12.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam package and not the pam package as distributed by Debian.

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.