Skip to content
OpenAdvisories
Critical USN-5825-1 1 CVE

pam vulnerability

Published Jan 25, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PAM did not correctly restrict login from an IP
address that is not resolvable via DNS. An attacker could possibly use this
issue to bypass authentication.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS pam 1.1.8-3.6ubuntu2.18.04.4
Ubuntu · 20.04 LTS 20.04:LTS pam 1.3.1-5ubuntu4.4
Ubuntu · 22.04 LTS 22.04:LTS pam 1.4.0-11ubuntu2.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS pam 1.1.8-1ubuntu2.2+esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS pam 1.1.8-3.2ubuntu2.3+esm2

Vulnerabilities 1

  • Critical 9.8
    CVE-2022-28321

    The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_acc…

    pam Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2022-28321