{"id":"CVE-2018-17953","aliases":["EUVD-2018-9694","GHSA-wwc4-7rwv-m5ch","SUSE-SU-2018:3965-1","openSUSE-SU-2024:11140-1"],"status":"published","title":"pam_access does not handle netmask matches correctly","description":"A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01342,"percentile":0.71548,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2018-11-27T13:00:00Z","modified":"2026-06-17T01:46:35Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"pam","fixed_in":["1.3.0-6.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"pam","fixed_in":["1.3.0-6.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-6.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-6.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-1.1"}]}],"bundled":2}],"products":[{"vendor":"kernel","product":"linux-pam"},{"vendor":"suse","product":"pam"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1115640","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17953"},{"url":"https://github.com/advisories/GHSA-wwc4-7rwv-m5ch"},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183965-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1115640","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17953","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27780","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-17953","title":"pam_access does not handle netmask matches correctly","description":"A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).","status":"published","published":"2018-11-27T13:00:00Z","modified":"2024-09-16T17:28:34.555Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:07.672841Z"}],"euvd":[{"id":"EUVD-2018-9694","description":"A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).","status":"published","published":"2018-11-27T13:00:00Z","modified":"2024-09-16T17:28:34Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:55:41.925187Z"}],"ghsa":[{"id":"GHSA-wwc4-7rwv-m5ch","title":"A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in...","description":"A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).","status":"published","published":"2022-05-13T01:33:43Z","modified":"2023-02-01T05:08:14Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:50:42.874485Z"}],"nvd":[{"id":"CVE-2018-17953","description":"A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).","status":"published","published":"2018-11-27T13:29:00.207Z","modified":"2026-06-17T01:46:35.5Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:04:48.987926Z"}],"osv":[{"id":"openSUSE-SU-2024:11140-1","title":"pam-1.5.2-1.1 on GA media","description":"These are all security issues fixed in the pam-1.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:00:31.831941Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:3965-1","title":"Security update for pam","description":"This update for pam fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2018-17953: Fixed IP address and subnet handling of pam_access.so that was not honoured correctly when a single host was specified (bsc#1115640).\n","status":"published","published":"2018-12-03T14:35:05Z","modified":"2026-02-04T04:10:17.518873Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}