agama-project / agama / 16616858218

64%

master: 75%

push

github

update pam crate not to use a vulnerable users dependency (bsc#1244200, CVE-2025-5791) (#2619)

## Problem

- We depend on a vulnerable crate: users- 0.10.0, via pam-0.8.0
- We do not use the vulnerable functionality
- https://bugzilla.suse.com/show_bug.cgi?id=1244200
- https://www.cve.org/CVERecord?id=CVE-2025-5791
- https://trello.com/c/vxZYhd1r

## Solution

Point Cargo.toml to an unreleased commit in `pam` that switches to the
`uzers` crate (which is a fork of the unmaintained vulnerable crate)

Currently targeting the RC3 branch

## Testing

- [x] manual test: authenticated in Agama web UI, correct password lets
me in ✔️, wrong password doesn't ✔️
- [x] packaging viability: in an OBS checkout I have changed `_service`
to point to my branch `<param
name="revision">insecure-users-crate</param>` and ran `osc service
manualrun`. `cargo vendor` and `cargo audit` ran without problems.

## Screenshots

No

## Documentation

No

2135 of 3884 branches covered (54.97%)

Branch coverage included in aggregate %.

24837 of 38108 relevant lines covered (65.18%)

49.14 hits per line