Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:02026-1

Опубликовано: 19 июн. 2025
Источник: suse-cvrf

Описание

Security update for pam_pkcs11

This update for pam_pkcs11 fixes the following issues:

  • CVE-2025-6018: Removes pam_env from auth stack for security reason (bsc#1243226).

Список пакетов

Image SLES15-SP6-Hardened-BYOS
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-Hardened-BYOS-Azure
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-Hardened-BYOS-EC2
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-Hardened-BYOS-GCE
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-SAP-Hardened
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-SAP-Hardened-Azure
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-SAP-Hardened-BYOS
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-SAP-Hardened-BYOS-Azure
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-SAP-Hardened-BYOS-EC2
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-SAP-Hardened-BYOS-GCE
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-SAP-Hardened-EC2
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-SAP-Hardened-GCE
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP7-Hardened-BYOS-Azure
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP7-Hardened-BYOS-EC2
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP7-Hardened-BYOS-GCE
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP7-SAP-Hardened-Azure
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP7-SAP-Hardened-BYOS-Azure
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP7-SAP-Hardened-BYOS-EC2
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP7-SAP-Hardened-BYOS-GCE
pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP7-SAP-Hardened-GCE
pam_pkcs11-0.6.10-150600.16.8.1
SUSE Linux Enterprise Module for Basesystem 15 SP6
pam_pkcs11-0.6.10-150600.16.8.1
pam_pkcs11-32bit-0.6.10-150600.16.8.1
SUSE Linux Enterprise Module for Basesystem 15 SP7
pam_pkcs11-0.6.10-150600.16.8.1
pam_pkcs11-32bit-0.6.10-150600.16.8.1
openSUSE Leap 15.6
pam_pkcs11-0.6.10-150600.16.8.1
pam_pkcs11-32bit-0.6.10-150600.16.8.1
pam_pkcs11-devel-doc-0.6.10-150600.16.8.1

Ссылки

Описание

A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.

Затронутые продукты
Image SLES15-SP6-Hardened-BYOS-Azure:pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-Hardened-BYOS-EC2:pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-Hardened-BYOS-GCE:pam_pkcs11-0.6.10-150600.16.8.1
Image SLES15-SP6-Hardened-BYOS:pam_pkcs11-0.6.10-150600.16.8.1
Ссылки