Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 24 Nov 2020 12:02:52 -0600
From: John Helmert III <>
Subject: Re: Heads up: PAM 1.5.0 has a auth bypass under some

On Tue, Nov 24, 2020 at 07:20:21PM +0100, Marcus Meissner wrote:
> Hi,
> (via IRC, spotted by Foxboron)
> PAM 1.5.0 had a potential auth bypass, if a user did not exist and the root password was
> empty (but root locked down).
> The reporters usecase was spammers pretending to be unknown users with a PAM enabled dovecot.
> This issue affected only pam 1.5.0.
> News entry:
> CVE-2020-27780
> github issue reporting the problem:
> Fixing commit:

It looks like that commit is in 1.5.0, and the issue was closed by
commit 30fdfb9 (not af0faf6).

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.