← Back

Pam Tacplus Project

pam_tacplus_project

3 CVEs • 1 product

Products (1)

Click to collapse
Toggle
Pam Tacplus
pam_tacplus
3 CVEs

CVEs (3)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-20014
1Pam Tacplus Project
1Pam Tacplus
Nov 21, 2024
Apr 21, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.
CVE-2020-27743
1Pam Tacplus Project
1Pam Tacplus
Jun 17, 2026
Oct 26, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.
CVE-2020-13881
4Arista
CanonicalDebian+1 more
4Cloudvision Portal
Debian LinuxPam Tacplus+1 more
Jun 17, 2026
Jun 6, 2020
N/A· v4
7.5 HIGH· v3
4.3 MEDIUM· v2
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.