PT-2020-13746

CVE-2020-13881

Published

2020-06-06

Updated

2022-04-05

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pam tacplus versions 1.3.8 through 1.5.1

Description The issue concerns the logging of the TACACS+ shared secret via syslog when the DEBUG loglevel and journald are used. This occurs in the support.c file of pam tacplus.

Recommendations For pam tacplus versions 1.3.8 through 1.5.1, consider disabling the DEBUG loglevel or journald to prevent the TACACS+ shared secret from being logged via syslog until a patch is available.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-532: Insertion of Sensitive Information into Log File

Related identifiers

CVE-2020-13881

DLA-2239-1

DLA-2730-1