SUSE-SU-2024:0136-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2024:0136-1

MEDIUM5.5

Security update for pam

Published Jan 18, 2024

Modified 2 years ago

Fix available

Details

Description of the patch:

This update for pam fixes the following issues:

CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation (bsc#1218475).
Check localtime_r() return value to fix crashing (bsc#1217000)

Affected Packages

pam

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.3.0-150000.6.66.1

pam-32bit

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.3.0-150000.6.66.1

pam-devel

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.3.0-150000.6.66.1

pam-devel-32bit

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS

Fixed in:

1.3.0-150000.6.66.1

pam-doc

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.3.0-150000.6.66.1

pam-extra

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.3.0-150000.6.66.1

pam-extra-32bit

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.3.0-150000.6.66.1

References

https://bugzilla.suse.com/1217000

https://bugzilla.suse.com/1218475

https://lists.suse.com/pipermail/sle-security-updates/2024-January/017681.html

https://www.suse.com/security/cve/CVE-2024-22365/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2024/suse-su-20240136-1/

CVSS Analysis

CVSS v3.1

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

5.5/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Upstream

Ecosystems(40)

SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise High Performance Computing 15 SP2

Timeline

PublishedJan 18, 2024

ModifiedJan 18, 2024