[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20250618060446.vn3lxwzqx5og35wa@jwilk.net>
Date: Wed, 18 Jun 2025 08:04:46 +0200
From: Jakub Wilk <jwilk@...lk.net>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-6019: LPE from allow_active to root in
libblockdev via udisks
* Qualys Security Advisory <qsa@...lys.com>, 2025-06-17 20:00:
>On Debian 12 and Ubuntu 24.04, when an unprivileged user logs in via
>sshd, PAM's pam_env module (from Linux-PAM 1.5.x) also reads this
>user's ~/.pam_environment file, because pam_env's "user_readenv" is
>explicitly set to 1 in /etc/pam.d/sshd (it is 0 by default, since
>Linux-PAM 1.4.0).
I reported this back in 2014:
https://bugs.debian.org/761600
--
Jakub Wilk
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
