agama-project / agama / 16565197393

22%

master: 81%

Pull #2619

github

update pam crate not to use a vulnerable users dependency (bsc#1244200, CVE-2025-5791)

users crate has a vulnerability where it will wrongly claim that a user
is present in the root group.
Agama had the users crate as a dependency, pulled in by the pam crate.

Agama is using pam only for root user authentication, so the vulnerability was not affecting it
https://github.com/agama-project/agama/blob/06c86349b/rust/agama-server/src/web/http.rs#L78

pam has merged a fix for this already, but not released it on crates.io: https://github.com/1wilkens/pam/pull/39 (The fix is from 2023-12 but the latest release was in 2023-11)

2135 of 3884 branches covered (54.97%)

Branch coverage included in aggregate %.

24838 of 38108 relevant lines covered (65.18%)

49.14 hits per line