CVE-2022-28321

 

Published at: - 20-09-2022 12:15

Last modified: - 22-09-2022 04:52

Total changes: - 3

Description

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://www.suse.com/security/cve/CVE-2022-28321.html
• http://download.opensuse.org/source/distribution/openSUSE-current/repo/oss/src/
• https://bugzilla.suse.com/show_bug.cgi?id=1197654

 

Keywords

NVD

 

CVE-2022-28321

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures