Описание
ELSA-2024-2438: pam security update (MODERATE)
[1.3.1-19.0.1]
- pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534]
[1.3.1-19]
- pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations. CVE-2024-22365. Resolves: RHEL-21244
[1.3.1-18]
- libpam: use getlogin() from libc and not utmp. Resolves: RHEL-16727
- pam_access: handle hostnames in access.conf. Resolves: RHEL-22300
[1.5.1-17]
- pam_faillock: create tallydir before creating tallyfile. Resolves: RHEL-20943
[1.5.1-16]
- libpam: use close_range() to close file descriptors. Resolves: RHEL-5099
- fix formatting of audit messages. Resolves: RHEL-5100
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
pam
1.5.1-19.0.1.el9
pam-devel
1.5.1-19.0.1.el9
pam-docs
1.5.1-19.0.1.el9
Oracle Linux x86_64
pam
1.5.1-19.0.1.el9
pam-devel
1.5.1-19.0.1.el9
pam-docs
1.5.1-19.0.1.el9
Связанные CVE
Связанные уязвимости
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a den ...