RHSA-2024:10379HighCVSS 7.4

Red Hat Security Advisory: pam security update

Published
November 26, 2024
Last Modified
November 5, 2026

🔗 CVE IDs covered (2)

CVE-2024-10041 →CVE-2024-10963 →

📋 Description

CVE-2024-10041 — pam: libpam: Libpam vulnerable to read hashed password CVE-2024-10963 — pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass

🎯 Affected products22

  • Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-0:1.3.1-36.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-0:1.3.1-36.el8_10.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-0:1.3.1-36.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-0:1.3.1-36.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-0:1.3.1-36.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-0:1.3.1-36.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-debuginfo-0:1.3.1-36.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-debuginfo-0:1.3.1-36.el8_10.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-debuginfo-0:1.3.1-36.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-debuginfo-0:1.3.1-36.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-debuginfo-0:1.3.1-36.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-debugsource-0:1.3.1-36.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-debugsource-0:1.3.1-36.el8_10.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-debugsource-0:1.3.1-36.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-debugsource-0:1.3.1-36.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-debugsource-0:1.3.1-36.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-devel-0:1.3.1-36.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-devel-0:1.3.1-36.el8_10.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-devel-0:1.3.1-36.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-devel-0:1.3.1-36.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • pam-devel-0:1.3.1-36.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: This vulnerability is mitigated if SELinux is in Enforcing mode. To verify if SELinux is in Enforcing mode, the output of the `getenforce` command will return `Enforcing', see the example below: ~~~ $ getenforce Enforcing ~~~ To more information about SELinux, specifically how to set it to Enforcing mode, see the links below. https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html-single/using_selinux/index#changing-to-enforcing-mode_changing-selinux-states-and-modes https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/using_selinux/index#changing-to-enforcing-mode_changing-selinux-states-and-modes Workaround: To reduce the risk, administrators should ensure that no DNS hostname matches local TTY or service names used in pam_access. Additionally, implement DNSSEC to prevent spoofing of DNS responses. For stronger protection, consider reconfiguring pam_access to only accept fully qualified domain names (FQDNs) in access.conf

🔗 References (6)