What’s Vulnerable › Vulnerabilities

CVE-2024-10963: Pam: improper hostname interpretation in pam_access leads to access control bypass

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-07 · updated 2026-10-13
• Weakness: CWE-287

Description

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions — fixed in 418.94.202502100215-0, v4.18.0-202412170221.p0.ga26fffe.assembly.stream.el9, v4.18.0-202412170221.p0.gcfbae04.assembly.stream.el9, v4.18.0-202412200107.p0.g2957f13.assembly.stream.el9, v4.18.0-202501201133.p0.g4674e81.assembly.stream.el9, v4.18.0-202501230001.p0.g00882ba.assembly.stream.el9
• Red Hat Enterprise Linux 8: all versions — fixed in 0:1.3.1-36.el8_10
• Red Hat Enterprise Linux 9: all versions — fixed in 0:1.5.1-22.el9_5
• Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 0:1.5.1-23.el9_4
• Red Hat OpenShift AI 2.16: all versions — fixed in v2.16.0-1733133582
• Red Hat OpenShift Container Platform 4.16: all versions — fixed in 416.94.202411261619-0
• Red Hat OpenShift Container Platform 4.17: all versions — fixed in 417.94.202411261220-0

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 418.94.202502100215-0, v4.18.0-202412170221.p0.ga26fffe.assembly.stream.el9, v4.18.0-202412170221.p0.gcfbae04.assembly.stream.el9, v4.18.0-202412200107.p0.g2957f13.assembly.stream.el9; Red Hat Enterprise Linux 8 0:1.3.1-36.el8_10; Red Hat Enterprise Linux 9 0:1.5.1-22.el9_5; Red Hat Enterprise Linux 9.4 Extended Update Support 0:1.5.1-23.el9_4; Red Hat OpenShift AI 2.16 v2.16.0-1733133582; Red Hat OpenShift Container Platform 4.16 416.94.202411261619-0; Red Hat OpenShift Container Platform 4.17 417.94.202411261220-0. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:10232
• https://access.redhat.com/errata/RHSA-2024:10244
• https://access.redhat.com/errata/RHSA-2024:10379
• https://access.redhat.com/errata/RHSA-2024:10518
• https://access.redhat.com/errata/RHSA-2024:10528
• https://access.redhat.com/errata/RHSA-2024:10852
• https://access.redhat.com/errata/RHSA-2024:6122
• https://access.redhat.com/security/cve/CVE-2024-10963
• https://bugzilla.redhat.com/show_bug.cgi?id=2324291
• https://github.com/linux-pam/linux-pam/issues/834
• https://github.com/linux-pam/linux-pam/pull/835

Get alerted when CVE-2024-10963 or the next vulnerability affects your stack