Threats tagged 'ghsa-mmj3-g9q3-fq2j'

A flaw in SSSD's PAM responder with the JSON PAM extension enabled allows a local attacker to cause a denial of service by submitting a crafted authentication request with a non-string OAuth2 code. This triggers a NULL pointer dereference, terminating the PAM responder and disrupting authentication. The issue affects builds starting with RHEL 9.8 and 10.2 where the JSON PAM extension is enabled. No confidentiality or integrity impact is established.