CVE-2020-27780
Fixed in a distro release EPSS 2%
A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.
Products: linux-pam
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.13 | linux-pam | 1.5.1 |
| Alpine 3.14 | linux-pam | 1.5.1-r0 |
| Alpine 3.15 | linux-pam | 1.5.1-r0 |
| Alpine 3.16 | linux-pam | 1.5.1-r0 |
| Alpine 3.17 | linux-pam | 1.5.1-r0 |
| Alpine 3.18 | linux-pam | 1.5.1-r0 |
| Alpine 3.19 | linux-pam | 1.5.1-r0 |
| Alpine 3.20 | linux-pam | 1.5.1-r0 |
| Alpine 3.21 | linux-pam | 1.5.1-r0 |
| Alpine 3.22 | linux-pam | 1.5.1-r0 |
| Alpine 3.23 | linux-pam | 1.5.1-r0 |
| Alpine 3.24 | linux-pam | 1.5.1-r0 |
| Arch Linux | pam | 1.5.0-2 |
| openSUSE Tumbleweed | pam | 1.5.2-1.1 |