Priority MEDIUM 46
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes().
Pam Tacplus Project
Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Pam Tacplus Project records in CISA KEVNo Pam Tacplus Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
3 records in Pam Tacplus · all components
TI-2016-09192 CVE-2016-20014 · GHSA-85mx-crqg-rfwj
In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.
Priority MEDIUM 45
In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.
TI-2020-10862 CVE-2020-13881 · GHSA-gm22-vmf2-hwxg
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged…
Priority LOW 36
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.