Security update for pam SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:4043-1 Final 1 1 2018-12-07T18:48:54Z current 2018-12-07T18:48:54Z 2018-12-07T18:48:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pam This update for pam fixes the following issue: Security issue fixed: - CVE-2018-17953: Fixed IP address and subnet handling of pam_access.so that was not honoured correctly when a single host was specified (bsc#1115640). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00015.html E-Mail link for openSUSE-SU-2018:4043-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 15.0 pam-1.3.0-lp150.5.6.1 pam-32bit-1.3.0-lp150.5.6.1 pam-devel-1.3.0-lp150.5.6.1 pam-devel-32bit-1.3.0-lp150.5.6.1 pam-doc-1.3.0-lp150.5.6.1 pam-1.3.0-lp150.5.6.1 as a component of openSUSE Leap 15.0 pam-32bit-1.3.0-lp150.5.6.1 as a component of openSUSE Leap 15.0 pam-devel-1.3.0-lp150.5.6.1 as a component of openSUSE Leap 15.0 pam-devel-32bit-1.3.0-lp150.5.6.1 as a component of openSUSE Leap 15.0 pam-doc-1.3.0-lp150.5.6.1 as a component of openSUSE Leap 15.0 A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open). CVE-2018-17953 openSUSE Leap 15.0:pam-1.3.0-lp150.5.6.1 openSUSE Leap 15.0:pam-32bit-1.3.0-lp150.5.6.1 openSUSE Leap 15.0:pam-devel-1.3.0-lp150.5.6.1 openSUSE Leap 15.0:pam-devel-32bit-1.3.0-lp150.5.6.1 openSUSE Leap 15.0:pam-doc-1.3.0-lp150.5.6.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00015.html https://www.suse.com/security/cve/CVE-2018-17953.html CVE-2018-17953 https://bugzilla.suse.com/1115640 SUSE Bug 1115640