Security Bulletin: IBM Verify Gateway does not hide a cryptographic key in one of its binary files (CVE-2020-4385)

Summary In one of the binary files distributed with the IBM Verify Gateway IVG components, it's possible to locate a hard-coded cryptographic key that's passed as an argument to an encryption function. As of v1.0.1 of IVG for RADIUS and IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM and IVG for...

Security Bulletin: IBM Verify Gateway does not prevent excessive authentication attempts (CVE-2020-4400)

Summary The IBM Verify Gateway IVG components do not prevent rapid, excessive attempts to authenticate with a time-based one-time password TOTP. Consequently, an attacker could brute force account credentials. As of v1.0.1 of IVG for RADIUS and IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM and...

Security Bulletin: IBM Verify Gateway PAM components include a leftover debug file (CVE-2020-4371)

Summary The IBM Verify Gateway IVG PAM components include a leftover header file in their installation packages. The file was needed for debugging during development and shouldn't be part of the delivered PAM components. As of v1.0.1 of IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM, the file h...

Security Bulletin: IBM Verify Gateway does not prevent excessive authentication attempts (CVE-2020-4400)

Summary The IBM Verify Gateway IVG components do not prevent rapid, excessive attempts to authenticate with a time-based one-time password TOTP. Consequently, an attacker could brute force account credentials. As of v1.0.1 of IVG for RADIUS and IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM and...

Security Bulletin: Authd service in the IBM Verify Gateway PAM components is vulnerable to denial of service attack (CVE-2020-4399)

Summary The IBM Verify Gateway IVG Authd service listens on TCP port 12. It's possible to mount a denial of service attack by sending malformed requests to port 12, thereby crashing the service. As of v1.0.1 of IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM, the Authd service is not used. The P...

SUSE SLES15 Security Update : rpmlint (SUSE-SU-2021:0658-1)

This update for rpmlint fixes the following issues : Whitelist PAM modules and DBUS rules for cockpit bsc1169614 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as...

SUSE-SU-2021:0658-1 Security update for rpmlint

This update for rpmlint fixes the following issues: - Whitelist PAM modules and DBUS rules for cockpit bsc1169614...

PT-2021-28410

Name of the Vulnerable Software and Affected Versions: rpmlint affected versions not specified Description: The issue involves whitelisting PAM modules and DBUS rules for cockpit. There is no information provided about the estimated number of potentially affected devices worldwide or details abou...

SUSE SLED15 / SLES15 Security Update : rpmlint (SUSE-SU-2021:0597-1)

This update for rpmlint fixes the following issues : Whitelist PAM modules and DBUS rules for cockpit bsc1169614 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as...

SUSE-SU-2021:0597-1 Security update for rpmlint

This update for rpmlint fixes the following issues: - Whitelist PAM modules and DBUS rules for cockpit bsc1169614...

PT-2021-28408

Name of the Vulnerable Software and Affected Versions: rpmlint affected versions not specified Description: The issue concerns rpmlint and involves whitelisting PAM modules and DBUS rules for cockpit. Recommendations: At the moment, there is no information about a newer version that contains a fi...

Huawei EulerOS: Security Advisory for gnome-keyring (EulerOS-SA-2021-1300)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : rpmlint (openSUSE-2021-45)

This update for rpmlint fixes the following issues : - Whitelist PAM modules and DBUS rules for cockpit bsc1169614 This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

CVE-2021-2014

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 5.7.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

CVE-2021-2014

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 5.7.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

UBUNTU-CVE-2021-2014

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 5.7.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

CVE-2021-2014

CVE-2021-2014 is a vulnerability in Oracle MySQL Server (Server: PAM Auth Plugin) affecting 5.7.32 and earlier. An authenticated attacker with network access via multiple protocols can exploit this to cause a denial of service (hang or crash) with an availability impact. The initial data lists a ...

CVE-2021-2014

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 5.7.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

CVE-2021-2014

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 5.7.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

CVE-2021-2014: Undefined Security Weakness

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 5.7.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...