Summary
USN-5825-1 fixed vulnerabilities in PAM. Unfortunately that update was
incomplete and could introduce a regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that PAM did not correctly restrict login from an IP
address that is not resolvable via DNS. An attacker could possibly use this
issue to bypass authentication.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | pam | 1.1.8-3.6ubuntu2.18.04.6 |
| Ubuntu · 20.04 LTS 20.04:LTS | pam | 1.3.1-5ubuntu4.6 |
| Ubuntu · 22.04 LTS 22.04:LTS | pam | 1.4.0-11ubuntu2.3 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | pam | 1.1.8-1ubuntu2.2+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | pam | 1.1.8-3.2ubuntu2.3+esm4 |
Vulnerabilities 1
-
Critical 9.8
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_acc…