CVE-2020-27780: 
NixOS vulnerability analysis and mitigation

A flaw was found in Linux-PAM (Pluggable Authentication Modules) in versions prior to 1.5.1 in the way it handles empty passwords for non-existing users. This vulnerability was identified as CVE-2020-27780 and was discovered in November 2020 (Openwall).

The vulnerability exists in the authentication mechanism where if a user doesn't exist, PAM attempts to authenticate with root credentials. In cases where the root password is empty, the authentication would successfully complete, potentially leading to unauthorized access. This issue specifically affected PAM version 1.5.0 (Bugzilla).

The vulnerability could allow unauthorized users to bypass authentication under specific conditions. The primary impact was observed in cases where spammers could potentially exploit this flaw by pretending to be unknown users with a PAM-enabled dovecot (Openwall).

The vulnerability is exploitable when two conditions are met: the user attempting to authenticate does not exist in the system, and the root account has an empty password but is locked down (Openwall).

The issue was fixed in Linux-PAM version 1.5.1. The fix was implemented through a patch that corrects the authentication handling for non-existent users (Bugzilla).