Linux-PAM 1.5.1 released
by Dmitry V. Levin
Hello,
I'm happy to announce that Linux-PAM 1.5.1 has been released.
Noteworthy changes in Linux-PAM 1.5.1:
* pam_unix: fixed CVE-2020-27780 - authentication bypass when a user
doesn't exist and root password is blank
* pam_faillock: added nodelay option to not set pam_fail_delay
* pam_wheel: use pam_modutil_user_in_group to check for the group membership
with getgrouplist where it is available
Release link with the tarballs and their signatures for download:
https://github.com/linux-pam/linux-pam/releases/tag/v1.5.1
Dmitry V. Levin, Tomas Mraz, Thorsten Kukuk
3 years, 4 months
Should we release 1.5.1
by Tomas Mraz
Unfortunately we have a security regression in 1.5.0 - public in
https://github.com/linux-pam/linux-pam/pull/298
and
https://github.com/linux-pam/linux-pam/pull/300
Should we obtain CVE id for that and release 1.5.1 asap? The severity
is low/medium as the issue affects only systems where the root account
already has blank password but the root login can be blocked by other
means in theory so I do not think we can dismiss it as a security issue
fully.
--
Tomáš Mráz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
[You'll know whether the road is wrong if you carefully listen to your
conscience.]
3 years, 4 months
Linux-PAM 1.5.0 released
by Dmitry V. Levin
Hello,
I'm happy to announce that Linux-PAM 1.5.0 has been released.
Noteworthy changes in Linux-PAM 1.5.0:
* Multiple minor bug fixes, portability fixes, and documentation improvements.
* Extended libpam API with pam_modutil_check_user_in_passwd function.
* configure: added --disable-unix option to disable build of pam_unix module.
* pam_faillock: changed /run/faillock/$USER permissions from 0600 to 0660.
* pam_limits: added support for nonewprivs item.
* pam_motd: read motd files with target user credentials skipping unreadable ones.
* pam_pwhistory: added a SELinux helper executable.
* pam_unix, pam_usertype: implemented avoidance of certain timing attacks.
* pam_wheel: implemented PAM_RUSER fallback for the case when getlogin fails.
* Removed deprecated pam_cracklib module, use pam_passwdqc (from passwdqc project)
or pam_pwquality (from libpwquality project) instead.
* Removed deprecated pam_tally and pam_tally2 modules, use pam_faillock instead.
* pam_env: Reading of the user environment is deprecated and will be removed
at some point in the future.
* libpam: pam_modutil_drop_priv() now correctly sets the target user's
supplementary groups, allowing pam_motd to filter messages accordingly.
Release link with the tarballs and their signatures for download:
https://github.com/linux-pam/linux-pam/releases/tag/v1.5.0
Dmitry V. Levin, Tomas Mraz, Thorsten Kukuk
3 years, 5 months
