CVE-2018-17953: pam_access does not handle netmask matches correctly
Published Nov 27, 2018
·Updated
A incorrect variable in a SUSE specific patch for pamaccess rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pamaccess rules not being applied (fail open).
Affected Software
3 affected components
kernel Linux-pam=1.3.0
openSUSE Leap=15.0
SUSE Linux Enterprise=15.0
Remediation
Patch Available
Event History
Nov 27, 2018
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2018-17953.
2
What is the severity level of CVE-2018-17953?
The severity level of CVE-2018-17953 is critical with a CVSS score of 8.1.
3
Which software versions are affected by CVE-2018-17953?
The affected software versions are PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15.
4
What is the impact of CVE-2018-17953?
CVE-2018-17953 could lead to pam_access rules not being applied (fail open).
5
Is there a fix available for CVE-2018-17953?
Yes, a SUSE specific patch is available to fix the issue. Please refer to the provided reference for more information.