Published: 24/09/2019 Updated: 27/02/2023

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

pam-python prior to 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root escalation in certain PAM setups.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pam-python project pam-python
debian debian linux 8.0
debian debian linux 9.0
debian debian linux 10.0
canonical ubuntu linux 18.04
canonical ubuntu linux 16.04

Debian Bug report logs - #942514 pam-python: CVE-2019-16729: local root escalation Package: src:pam-python; Maintainer for src:pam-python is Russell Stuart <russell-debian@stuartidau>; Reported by: Hugo Lefeuvre <hle@debianorg> Date: Thu, 17 Oct 2019 11:42:02 UTC Severity: important Tags: fixed-upstream, security, ...

Malte Kraus discovered that libpam-python, a PAM module allowing PAM modules to be written in Python, didn't sanitise environment variables which could result in local privilege escalation if used with a setuid binary For the oldstable distribution (stretch), this problem has been fixed in version 106-11+deb9u1 For the stable distribution (bus ...

CVE-2019-16729 trickery and beyond Intro When I was reading an article about customized PAM setups, pam_python crossed my way Having done quite some Python code reviews in critical places and knowing that its very hard to secure privileged Python code, I wondered how secure it could be Being a C and C++ coder with passion and hearing a lot of unsolicated langsec rantings for

NVD-CWE-noinfo https://tracker.debian.org/news/1066790/accepted-pam-python-107-1-source-amd64-all-into-unstable/https://bugzilla.suse.com/show_bug.cgi?id=1150510#c1 https://sourceforge.net/p/pam-python/code/ci/0247ab687b4347cc52859ca461fb0126dd7e2ebe/https://www.debian.org/security/2019/dsa-4555 https://lists.debian.org/debian-lts-announce/2019/11/msg00020.html https://usn.ubuntu.com/4552-1/https://usn.ubuntu.com/4552-2/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942514 https://nvd.nist.gov https://www.debian.org/security/2019/dsa-4555

CVE-2019-16729

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect