PT-2019-18677
CVE-2019-7639
·
Published
2019-02-08
·
Updated
2020-08-24
Description by
CVSS 3.1
8.1
HighMetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
gsi-openssh-server version 7.9p1
Description
An issue allows logins to succeed with a valid username and an incorrect password when PermitPAMUserChange is set to yes in the /etc/gsissh/sshd config file, despite recording a failure entry in the /var/log/messages file.
Recommendations
For gsi-openssh-server version 7.9p1, consider setting PermitPAMUserChange to no in the /etc/gsissh/sshd config file as a temporary workaround to prevent logins with incorrect passwords.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾