{"id":"CLSA-2026-1790600614","summary":"pam: Fix of 3 CVEs","details":"- Rebase onto the vendor's 1.1.8-23.0.3 sources\n- CVE-2024-10041: fix possibility of leakage of secret information\n  stored in memory\n- CVE-2025-6020: take the vendor's fix and carry the parts of ours it\n  omits: upstream 976c2007, namespace.init path-safety flags, helper fd\n  sanitizing\n- CVE-2024-22365 is now fixed by the vendor's pam_namespace rewrite, which\n  replaces protect_dir() with secure_opendir(); the TuxCare duplicate is dropped","modified":"2026-10-26T09:43:55.799826458Z","published":"2026-09-28T13:03:43Z","upstream":["CVE-2024-10041","CVE-2024-22365","CVE-2025-6020"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1790600614.html"}],"affected":[{"package":{"name":"pam","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/pam?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-23.0.3.el7.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1790600614.json"}},{"package":{"name":"pam-devel","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/pam-devel?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-23.0.3.el7.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1790600614.json"}}],"schema_version":"1.9.0"}