Insecure Storage of Sensitive Information Affecting pam-devel package, versions <0:1.5.1-21.0.1.el9_5


Severity

Recommended
0.0
medium
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.05% (24th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-PAMDEVEL-8547254
  • published21 Dec 2024
  • disclosed23 Oct 2024

Introduced: 23 Oct 2024

CVE-2024-10041  (opens in a new tab)
CWE-922  (opens in a new tab)

How to fix?

Upgrade Oracle:9 pam-devel to version 0:1.5.1-21.0.1.el9_5 or higher.
This issue was patched in ELSA-2024-11250.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam-devel package and not the pam-devel package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

CVSS Scores

version 3.1