Date: 2024-12-12 Updated:
PAM host name spoofing vulnerability
HIGH risk vulnerability concerning PAM. A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. [R 3]
EGI SVG ID : EGI-SVG-2024-28
CVE ID : CVE-2024-10963
CVSS Score : 7.4 [R 1]
Sites are recommended to update relevant components as soon as possible using information in the references below.
RedHat suggests some Mitigation in [R 3]
The EGI SVG is unsure how widely this can be exploited in EGI, but we think it may be exploitable in some configurations. We have assessed as ‘HIGH’ due to the serious impact if it is exploitable.
TLP:CLEAR information - Unimited distribution
https://advisories.egi.eu/Advisory-EGI-SVG-2024-28
https://advisories.egi.eu/Advisory-SVG-CVE-2024-10963
Minor updates may be made without re-distribution to the sites.
This advisory is subject to the Creative Commons licence
https://creativecommons.org/licenses/by/4.0/ and
the EGI (https://www.egi.eu/) Software Vulnerability Group
must be credited. -
Comments or questions should be sent to svg-rat at mailman.egi.eu
Vulnerabilities relevant for EGI can be reported at report-vulnerability at egi.eu
(see [R 99] for further details, and other information on SVG)
[R 4] https://security-tracker.debian.org/tracker/CVE-2024-10963
[R 6] https://errata.build.resf.org/ (RockyLinux)
[R 7] https://errata.almalinux.org/ (AlmaLinux)
[R 99] https://confluence.egi.eu/display/EGIBG/SVG+Advisories
SVG was alerted to this vulnerability by Mischa Salle