Authentication mechanism absence or evasion In util-linux
Description
login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | 2.17.2-9 | ||
debian 11 | 2.17.2-9 | ||
debian 14 | 2.17.2-9 | ||
debian 13 | 2.17.2-9 |
Aliases
1. 2. 3. 4. 5.