Description
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
References (7)
Core 7
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/kravietz/pam_tacplus/issues/149
Patch, Third Party Advisory x_refsource_misc
https://github.com/kravietz/pam_tacplus/commit/4a9852c31c2fd0c0e72fbb689a586aabcfb11cb0
Mailing List, Patch, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2020/06/08/1
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/06/msg00007.html
Third Party Advisory x_refsource_misc
https://www.arista.com/en/support/advisories-notices/security-advisories/11705-security-advisory-50
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/4521-1/
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/08/msg00006.html
Scores
CVSS v3
7.5
EPSS
0.0124
EPSS Percentile
79.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-532
Status
published
Products (7)
arista/cloudvision_portal
< 2020.1.2
canonical/ubuntu_linux
16.04
canonical/ubuntu_linux
18.04
canonical/ubuntu_linux
20.04
debian/debian_linux
8.0
debian/debian_linux
9.0
pam_tacplus_project/pam_tacplus
1.3.8 - 1.5.1
Published
Jun 06, 2020
Tracked Since
Feb 18, 2026