Vulnerability Details CVE-2019-16729
pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root escalation in certain PAM setups.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 30.9%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 7.2
References
- https://bugzilla.suse.com/show_bug.cgi?id=1150510#c1
- https://lists.debian.org/debian-lts-announce/2019/11/msg00020.html
- https://sourceforge.net/p/pam-python/code/ci/0247ab687b4347cc52859ca461fb0126dd7e2ebe/
- https://tracker.debian.org/news/1066790/accepted-pam-python-107-1-source-amd64-all-into-unstable/
- https://usn.ubuntu.com/4552-1/
- https://usn.ubuntu.com/4552-2/
- https://www.debian.org/security/2019/dsa-4555
- https://bugzilla.suse.com/show_bug.cgi?id=1150510#c1
- https://lists.debian.org/debian-lts-announce/2019/11/msg00020.html
- https://sourceforge.net/p/pam-python/code/ci/0247ab687b4347cc52859ca461fb0126dd7e2ebe/
- https://tracker.debian.org/news/1066790/accepted-pam-python-107-1-source-amd64-all-into-unstable/
- https://usn.ubuntu.com/4552-1/
- https://usn.ubuntu.com/4552-2/
- https://www.debian.org/security/2019/dsa-4555
Products affected by CVE-2019-16729
-
cpe:2.3:a:pam-python_project:pam-python:-
-
cpe:2.3:a:pam-python_project:pam-python:1.0.4-1
-
cpe:2.3:a:pam-python_project:pam-python:1.0.5-1
-
cpe:2.3:a:pam-python_project:pam-python:1.0.6-1
-
cpe:2.3:o:canonical:ubuntu_linux:16.04
-
cpe:2.3:o:canonical:ubuntu_linux:18.04
-
cpe:2.3:o:debian:debian_linux:10.0
-
cpe:2.3:o:debian:debian_linux:8.0
-
cpe:2.3:o:debian:debian_linux:9.0