Re: CVE request: pam_ssh not dropping root gid(s)

[Josh Bressers <bressers () redhat com>]

----- Original Message -----
> Hi,
>
> In certain configs, pam_ssh is not completely dropping its privileges to
> user. It just forgets to call setgid() and initgroups(). A fix can be
> found at [1].  Can someone assign a CVE?
>
> thx,
> Sebastian
>
> [1] https://bugzilla.novell.com/show_bug.cgi?id=665061

Is this a security flaw? From doing a little ssh-agent research, it sounds
harmless without another flaw. I'm not terribly familiar with it though, so
I could be missing something.

Thanks.

-- 
    JB