SUSE-SU-2024:0136-1: Security update for pam
This update for pam fixes the following issues: CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation (bsc#1218475). Check localtimer() return value to fix crashing (bsc#1217000)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/pamto a version that resolves this vulnerability.Fixed in 1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pam-debuginfoto a version that resolves this vulnerability.Fixed in 1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pam-debugsourceto a version that resolves this vulnerability.Fixed in 1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pam-develto a version that resolves this vulnerability.Fixed in 1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pam-extra-debuginfoto a version that resolves this vulnerability.Fixed in 1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pam-extrato a version that resolves this vulnerability.Fixed in 1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pam-docto a version that resolves this vulnerability.Fixed in 1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pam-extrato a version that resolves this vulnerability.Fixed in 32bit-debuginfo-1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pam-extrato a version that resolves this vulnerability.Fixed in 32bit-1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pamto a version that resolves this vulnerability.Fixed in 32bit-1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pamto a version that resolves this vulnerability.Fixed in 32bit-debuginfo-1.3.0-150000.6.66.1 - Upgrade
Upgrade
suse/pam-develto a version that resolves this vulnerability.Fixed in 32bit-1.3.0-150000.6.66.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.3-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.4-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.5-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP5-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-RT-15-SP4-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP1-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.3-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SUSE-MicroOS-5.1-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SUSE-MicroOS-5.2-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.3-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.4-2024-136=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-136=1
Event History
Frequently Asked Questions
Which systems and packages are covered by this update?
The update applies to PAM packages on SUSE Linux Enterprise Micro for Rancher 5.3 for aarch64, s390x, and x86_64. Listed packages include pam, pam-extra, pam-devel, pam-doc, and associated debug packages.
What level of access does an attacker need to exploit the CVE-fixed issue?
CVE-2024-22365 is a local denial-of-service issue during PAM login. The provided information does not indicate a remote exploitation path.