Vulnerability in pam_oath, allowing for root privileges on the system
In the PAM module pam_oath, which is part of the oath-toolkit package and used for two-factor authentication with one-time passwords (OTP), a vulnerability (CVE-2024-47191) has been identified that allows an unprivileged user to gain root access on the system. The pam_oath module runs with root privileges and was originally designed to store OATH keys in the file /etc/users.oath, which is accessible only to the root user. In version 2.6.7 of the oath-toolkit […]
