Critical · published September 20, 2022
🔥 An authentication bypass is lurking in openSUSE Tumbleweed! A sneaky flaw in the Linux-PAM package allows unauthorized SSH logins from non-resolvable IP addresses. 😱 Think of it like a nightclub that doesn't check guest lists properly — if you're trying to get in from a blocked entrance, but there's no guard at that door, you might just slip in unnoticed! An attacker could exploit this vulnerability to gain access to a machine, bypassing authentication entirely. This could lead to unauthorized modifications, access to sensitive data, or even a complete takeover of the system — absolutely devastating!
Think of it like a nightclub that doesn't check guest lists properly — if you're trying to get in from a blocked entrance, but there's no guard at that door, you might just slip in unnoticed! This vulnerability occurs in the pam_access.so module, which fails to restrict login attempts from IPs that aren't resolvable via DNS, allowing access for users who should be denied.
An attacker could exploit this vulnerability to gain access to a machine, bypassing authentication entirely. This could lead to unauthorized modifications, access to sensitive data, or even a complete takeover of the system — absolutely devastating! To safeguard your systems, immediately update the Linux-PAM package to version 1.5.2-6.1 or later. Ensure that you review your SSH configurations to limit access based on resolvable IP addresses and audit your user permissions. You've got this! Implement these fixes, and you'll fortify your defenses in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| linux-pam/linux-pam | < 1.5.2-6.1 | 1.5.2-6.1 |