Описание
Improper Input Validation in libpam4j
It was found that libpam4j prior to 1.10 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2017-12197
- https://github.com/kohsuke/libpam4j/issues/18
- https://github.com/kohsuke/libpam4j/commit/02ffdff218283629ba4a902e7fe2fd44646abc21
- https://access.redhat.com/errata/RHSA-2017:2904
- https://access.redhat.com/errata/RHSA-2017:2905
- https://access.redhat.com/errata/RHSA-2017:2906
- https://bugzilla.redhat.com/show_bug.cgi?id=1503103
- https://lists.debian.org/debian-lts-announce/2017/11/msg00008.html
- https://www.debian.org/security/2017/dsa-4025
Пакеты
org.kohsuke:libpam4j
< 1.10
1.10
Связанные уязвимости
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
It was found that libpam4j up to and including 1.8 did not properly va ...