What’s Vulnerable › Vulnerabilities

CVE-2020-27678

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-26 · updated 2026-06-17
• Weakness: CWE-120

Description

An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.

Affected products

• Illumos: before 2020-10-22 — fixed in 2020-10-22
• Joyent SmartOS: before 20201022 — fixed in 20201022
• Omniosce Omnios: before r151030by; from r151032 through r151032ay; from r151034 before r151034y — fixed in r151030by, r151034y

How to fix

Upgrade to a fixed version: Illumos 2020-10-22; Joyent SmartOS 20201022; Omniosce Omnios r151030by, r151034y. Check the vendor advisory for mitigations.

References

• https://github.com/illumos/illumos-gate/commit/1d276e0b382cf066dae93640746d8b4c54d15452
• https://github.com/illumos/illumos-gate/commit/1d276e0b382cf066dae93640746d8b4c54d15452

Get alerted when CVE-2020-27678 or the next vulnerability affects your stack