CVE-2020-27743

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/kravietz/pam_tacplus/pull/163Third Party Advisory
https://tools.ietf.org/html/rfc8907Technical Description, Third Party Advisory
https://github.com/kravietz/pam_tacplus/pull/163Third Party Advisory
https://tools.ietf.org/html/rfc8907Technical Description, Third Party Advisory

Timeline

Published: Oct 26, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-277449.8An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114. They allow remote code execution with resultant escalation CVE-2020-277459.8Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin.CVE-2020-277463.7Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is a CVE-2020-277476.8An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for enteri CVE-2020-277486.5A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be CVE-2020-277496.7A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their correspondi CVE-2020-27755.3Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affecte CVE-2020-277505.5A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is CVE-2020-277513.3A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick coul CVE-2020-277527.1A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick cou CVE-2020-277535.5There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially CVE-2020-277543.3In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller wh