CVE-2023-45239: Input Validation
A lack of input validation exists in tacplus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tacplus to inject shell commands and gain remote code execution on the tacplus server.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-45239.
What is the severity of CVE-2023-45239?
The severity of CVE-2023-45239 is critical with a severity value of 9.8.
What is the affected software of CVE-2023-45239?
The affected software of CVE-2023-45239 includes Facebook Tac Plus versions up to and excluding 2023-10-05 and Fedora versions 39.
How can an attacker exploit CVE-2023-45239?
An attacker who can control the username, rem-addr, or NAC address sent to tac_plus can inject shell commands and gain remote code execution on the tac_plus server.
Are there any references for further information?
Yes, you can find more information on this vulnerability at the following references: [GitHub](https://github.com/facebook/tac_plus/pull/41), [GitHub Security Advisory](https://github.com/facebook/tac_plus/security/advisories/GHSA-p334-5r3g-4vx3), [Fedora Project Mailing List](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4J7ZYMFZB4G4OU5EDJPQLP6F6RKDGIH/)