ROS-20250723-01

The vulnerability of the PAM-PKCS11 authentication module of Linux operating systems is related to the fact that the value of the certpolicy defaults to "none". Exploitation of the vulnerability could allow an attacker acting remotely to bypass the authentication process. remotely to bypass the...

Advisory ROSA-SA-2025-2822

Software: pampkcs11 0.6.13 OS: ROSA Virtualization 3.0 packageevrstring: pampkcs11-0.6.13-1.rv30 CVE-ID: CVE-2025-24032 BDU-ID: None CVE-Crit: DATA LOSSES. CVE-DESC.: The PAM-PKCS11 vulnerability allows an attacker to log in to a user account using a token created by the user. CVE-STATUS: The...

[SECURITY] [DSA 5864-1] pam-pkcs11 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5864-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 12, 2025 https://www.debian.org/security/faq -...

CVE-2025-24032 PAM-PKCS#11 vulnerable to authentication bypass with default value for `cert_policy` (`none`)

PAM-PKCS11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if certpolicy is set to none the default value, then pampkcs11 will only check if the user is capable of logging into the token. An attacker may create a different token with the user...