PT-2018-14297 · Suse+1 · Opensuse Leap+3

Daniel Pecka · Published 2018-11-27 · Updated 2024-06-15 · CVE-2018-17953

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions openSUSE Leap version 15.0 SUSE Linux Enterprise version 15

Description The issue is related to an incorrect variable in a SUSE specific patch for pam access rule matching in PAM, which could lead to pam access rules not being applied, resulting in a fail open scenario.

Recommendations For openSUSE Leap version 15.0, update the PAM package to a version that includes the corrected patch. For SUSE Linux Enterprise version 15, apply the appropriate patch or update to ensure pam access rules are correctly applied.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2018-17953

OPENSUSE-SU-2018_4043-1

OPENSUSE-SU-2024:11140-1

SUSE-SU-2018:3965-1

SUSE-SU-2018_3965-1

Affected Products

Pam

Suse Linux Enterprise

Suse

Opensuse Leap

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2018-17953 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17953 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3965-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11140-1 · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1115640 · Note
• https://suse.com/support/update/announcement/2018/suse-su-20183965-1 · Note
• https://suse.com/security/cve/CVE-2020-27780 · Note
• https://bugzilla.suse.com/1115640 · Note
• https://suse.com/security/cve/CVE-2018-17953 · Note