GCVE - cpe:2.3:a:pam_tacplus_project:pam

Approved changes feed: RSS · Atom

cpe:2.3:a:pam_tacplus_project:pam_tacplus:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Pam Tacplus Project (`e0c67352-308c-5888-9b7e-31bcbde7eabe`)
Product	Pam Tacplus (`8b78a8ba-f1fc-54ec-b22d-6c1f5b77a522`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/spectracom/pam-tacplus`	purl2cpe	2026-06-01 10:17:50.897464
`pkg:github/kravietz/pam_tacplus`	purl2cpe	2026-06-01 10:17:50.897467
`pkg:rpm/opensuse/pam_tacplus`	purl2cpe	2026-06-01 10:17:50.897470

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-27743`	vulnerable	2026-06-08 05:23:53.097681	Details available libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id. Published: 2020-10-26T21:40:19.000Z Updated: 2024-08-04T16:18:45.595Z Open on db.gcve.eu Reference links https://github.com/kravietz/pam_tacplus/pull/163 https://tools.ietf.org/html/rfc8907	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-13881`	vulnerable	2026-06-08 05:18:01.280301	Details available In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. Published: 2020-06-06T18:18:36.000Z Updated: 2024-08-04T12:32:14.180Z Open on db.gcve.eu Reference links https://github.com/kravietz/pam_tacplus/issues/149 https://github.com/kravietz/pam_tacplus/commit/4a9852c31c2fd0c0e72fbb689a586aabcfb11cb0 http://www.openwall.com/lists/oss-security/2020/06/08/1 https://lists.debian.org/debian-lts-announce/2020/06/msg00007.html https://www.arista.com/en/support/advisories-notices/security-advisories/11705-security-advisory-50	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-20014`	vulnerable	2026-06-08 05:07:32.519878	Details available In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure. Published: 2022-04-21T03:58:30.000Z Updated: 2024-08-06T03:47:34.924Z Open on db.gcve.eu Reference links https://github.com/kravietz/pam_tacplus/commit/e4c00eba70a0f72c4de77b5f072c69708ec2beab	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Pam Tacplus

Notes

PURL mappings

Vulnerability references

Contribute