CVE-2020-27780: Critical severity suse pam vulnerability
A flaw was found in Linux-Pam in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.
Reference: https://github.com/linux-pam/linux-pam/issues/284
Upstream patch: https://github.com/linux-pam/linux-pam/pull/300
Other sources
A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw in Linux-Pam?
The vulnerability ID for this flaw in Linux-Pam is CVE-2020-27780.
What is the severity of CVE-2020-27780?
CVE-2020-27780 has a severity rating of 9.8 (Critical).
How does this vulnerability in Linux-Pam affect security?
This vulnerability in Linux-Pam allows an attacker to authenticate with root privileges using an empty password for non-existing users.
Which versions of Linux-Pam are affected by CVE-2020-27780?
Versions of Linux-Pam prior to 1.5.1 are affected by CVE-2020-27780.
How can I fix CVE-2020-27780 in Linux-Pam?
To fix CVE-2020-27780, update Linux-Pam to version 1.5.1 or later.