On Mon, 2020-11-23 at 10:49 +0100, Thorsten Kukuk wrote:
Hi,
On Mon, Nov 23, Tomas Mraz wrote:
Unfortunately we have a security regression in 1.5.0 - public in
https://github.com/linux-pam/linux-pam/pull/298
and
https://github.com/linux-pam/linux-pam/pull/300
Should we obtain CVE id for that and release 1.5.1 asap? The severity is low/medium as the issue affects only systems where the root account already has blank password but the root login can be blocked by other means in theory so I do not think we can dismiss it as a security issue fully.
We should release 1.5.1 asap, but I don't think we need a CVE for this.
IMO if we regard this as security issue we should get CVE number. Only in case we do not regard it as such - i.e. we think it is just plain regression bug we should not get CVE.
My personal opinion is that this is a security issue although low or medium one only. But I can be persuaded otherwise.