This page aggregates publicly disclosed CVE and security risk information related to pam_tacplus_project, with CVSS, EPSS, publication dates, and vulnerability intelligence data to help assess potential risk and remediation priority.
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2016-20014 | In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure. | [email protected] | 9.8 | 1.19% | 2022-04-21 | 2024-11-21 |
| CVE-2020-27743 | libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id. | [email protected] | 9.8 | 1.71% | 2020-10-26 | 2024-11-21 |
| CVE-2020-13881 | In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. | [email protected] | 7.5 | 1.67% | 2020-06-06 | 2024-11-21 |