PT-2024-16667 · Red Hat+6 · Red Hat Nan+7

Published

2024-11-07

·

Updated

2025-10-09

·

CVE-2024-10963

CVSS v3.1

7.4

High

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions pam access (affected versions not specified) Red Hat Nan (affected versions not specified)
Description A flaw was found in pam access, where certain rules in its configuration file are mistakenly treated as hostnames. This issue allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. The flaw poses a risk in environments relying on these configurations for local access control.
Recommendations For pam access, update to the latest patched version to mitigate risks. For Red Hat Nan, update to the latest patched version to mitigate risks. As a temporary workaround, consider reviewing access.conf configurations to limit network exposure. Restrict access to sensitive services or terminals until the issue is resolved. At the moment, there is no information about specific versions that contain a fix for this vulnerability.

Fix

Race Condition

Improper Authentication

Path traversal

Weakness Enumeration

Related Identifiers

ALSA-2024:10244
ALSA-2024:10379
AZL-52539
BDU:2025-02448
BDU:2025-07273
CESA-2024_10379
CVE-2024-10963
INFSA-2024_10244
INFSA-2024_10379
OESA-2024-2501
OPENSUSE-SU-2024:14563-1
RHSA-2024:10232
RHSA-2024:10244
RHSA-2024:10379
RHSA-2024_10244
RHSA-2024_10379
RLSA-2024:10244
RLSA-2024:10379
SUSE-SU-2025:20104-1
SUSE-SU-2025:20229-1
USN-7761-1

Affected Products

Almalinux
Centos
Linuxmint
Red Hat
Red Hat Nan
Red Os
Rocky Linux
Ubuntu