projects / buildroot.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ef4f72a) | patch
package/libpam-tacplus: fix CVE-2020-27743
authorFabrice Fontaine <fontaine.fabrice@gmail.com>
Wed, 28 Oct 2020 08:26:58 +0000 (09:26 +0100)
committerThomas Petazzoni <thomas.petazzoni@bootlin.com>
Thu, 29 Oct 2020 22:38:48 +0000 (23:38 +0100)
commit70499767e510cf02e6b6771c51c8720defe99c54
tree0900aef7f5119254dfa7d857f84b488e0c3f6e72tree
parentef4f72aef7bf87ed0c31fbabedca3904053c39d8commit | diff
package/libpam-tacplus: fix CVE-2020-27743

libtac in pam_tacplus through 1.5.1 lacks a check for a failure of
RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a
non-random/predictable session_id.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
package/libpam-tacplus/0005-Check-for-failure-of-OpenSSL-RAND_pseudo_bytes.patch [new file with mode: 0644] blob
package/libpam-tacplus/libpam-tacplus.mk diff | blob | history