CVE-2001-1459: OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are e...

Security readout for executives and security teams

This is an old OpenSSH issue where local users could avoid PAM-enforced resource limits when running SSH commands without a pseudo-terminal. The business risk is mainly on legacy systems that still rely on PAM rlimits to contain user activity. The source bundle does not show active exploitation or a CVSS score. Exposure is most likely on legacy hosts running OpenSSH 2.9 or earlier with PAM-based rlimit controls. Modern supported OpenSSH deployments are unlikely to match this description, but the bundle does not provide complete affected-product metadata. Treat this as a legacy exposure cleanup item unless critical systems still run affected OpenSSH with PAM rlimit controls. Prioritize discovery first, then upgrade or isolate any matching hosts. Mitigation focus: Inventory systems for OpenSSH 2.9 or earlier.; Check vendor guidance for the applicable OpenSSH package.; Upgrade legacy OpenSSH to a supported vendor-maintained release..

Prepared

Jun 29, 2026, 22:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.