There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-
    existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty
    password it successfully authenticate. (CVE-2020-27780)

遠端主機受到 GLSA-202012-06 中所述的弱點影響 (Linux-PAM：驗證繞過)

    在 Linux-Pam 處理非現有使用者的空白密碼的方式中發現一個瑕疵。
  影響：

    遠端攻擊者只需要知道非現有使用者名稱，就可以繞過安全性限制並驗證成為 Root 使用者。
  因應措施：

    確保 Root 帳戶受到非空白密碼保護。

远程主机受到 GLSA-202012-06 中所述漏洞的影响（Linux-PAM：认证绕过）

    在 Linux-Pam 处理不存在用户的空密码的方式中发现一个缺陷。
  影响：

    远程攻击者只需知道不存在的用户名，即可绕过安全限制并验证为 root 用户。
  变通方案：

    确保 root 帐户受非空密码的保护。

CVE-2020-27780 を修正：ユーザーが存在しない場合の認証バイパス

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

fix CVE-2020-27780: authentication bypass when the user doesn't exist

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202012-06 (Linux-PAM: Authentication bypass)

    A flaw was found in Linux-Pam in the way it handle empty passwords for       non-existing users.
  Impact :

    A remote attacker, who only needs to know a non-existing username, could       bypass security restrictions and authenticate as root user.
  Workaround :

    Ensure that root account is protected by a non-empty password.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
424120	Alpine: multiple linux-pam packages: security update to 1.5.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/4/4	2026/7/2	critical
424120	Alpine: multiple linux-pam packages: security update to 1.5.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/4/4	2026/7/2	critical
405465	Alpine: linux-pam: security update to 1.5.1	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	critical
405465	Alpine: linux-pam: security update to 1.5.1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	critical
143493	GLSA-202012-06：Linux-PAM：驗證繞過	Nessus	Gentoo Local Security Checks	2020/12/7	2024/2/7	critical
143493	GLSA-202012-06 : Linux-PAM：绕过身份验证	Nessus	Gentoo Local Security Checks	2020/12/7	2024/2/7	critical
144091	Fedora 32：pam（2020-bd83344365）	Nessus	Fedora Local Security Checks	2020/12/11	2024/2/2	critical
143326	Fedora 33：pam（2020-22532a1a81）	Nessus	Fedora Local Security Checks	2020/11/30	2024/2/7	critical
144091	Fedora 32 : pam (2020-bd83344365)	Nessus	Fedora Local Security Checks	2020/12/11	2024/2/2	critical
143493	GLSA-202012-06 : Linux-PAM: Authentication bypass	Nessus	Gentoo Local Security Checks	2020/12/7	2024/2/7	critical
143326	Fedora 33 : pam (2020-22532a1a81)	Nessus	Fedora Local Security Checks	2020/11/30	2024/2/7	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical