RHSA-2024:10244HighCVSS 7.4

Red Hat Security Advisory: pam:1.5.1 security update

Published
November 25, 2024
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2024-10963 →

📋 Description

CVE-2024-10963 — pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass

🎯 Affected products37

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-0:1.5.1-22.el9_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-0:1.5.1-22.el9_5.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-0:1.5.1-22.el9_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-0:1.5.1-22.el9_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-0:1.5.1-22.el9_5.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-0:1.5.1-22.el9_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-debuginfo-0:1.5.1-22.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-debuginfo-0:1.5.1-22.el9_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-debuginfo-0:1.5.1-22.el9_5.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-debuginfo-0:1.5.1-22.el9_5.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-debuginfo-0:1.5.1-22.el9_5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-debuginfo-0:1.5.1-22.el9_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-debuginfo-0:1.5.1-22.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-debuginfo-0:1.5.1-22.el9_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-debuginfo-0:1.5.1-22.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-debuginfo-0:1.5.1-22.el9_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-debugsource-0:1.5.1-22.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-debugsource-0:1.5.1-22.el9_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-debugsource-0:1.5.1-22.el9_5.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-debugsource-0:1.5.1-22.el9_5.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-debugsource-0:1.5.1-22.el9_5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-debugsource-0:1.5.1-22.el9_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-debugsource-0:1.5.1-22.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-debugsource-0:1.5.1-22.el9_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-debugsource-0:1.5.1-22.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-debugsource-0:1.5.1-22.el9_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • pam-devel-0:1.5.1-22.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • pam-devel-0:1.5.1-22.el9_5.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +7 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To reduce the risk, administrators should ensure that no DNS hostname matches local TTY or service names used in pam_access. Additionally, implement DNSSEC to prevent spoofing of DNS responses. For stronger protection, consider reconfiguring pam_access to only accept fully qualified domain names (FQDNs) in access.conf

🔗 References (4)