Hi,
On Mon, Nov 23, Tomas Mraz wrote:
Unfortunately we have a security regression in 1.5.0 - public in
https://github.com/linux-pam/linux-pam/pull/298
and
https://github.com/linux-pam/linux-pam/pull/300
Should we obtain CVE id for that and release 1.5.1 asap? The severity is low/medium as the issue affects only systems where the root account already has blank password but the root login can be blocked by other means in theory so I do not think we can dismiss it as a security issue fully.
We should release 1.5.1 asap, but I don't think we need a CVE for this.
Thorsten
-- Tomáš Mráz No matter how far down the wrong road you've gone, turn back. Turkish proverb [You'll know whether the road is wrong if you carefully listen to your conscience.]
Pam-developers mailing list -- pam-developers@lists.fedorahosted.org To unsubscribe send an email to pam-developers-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/pam-developers@lists.fedorahost...