Description
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | pam | 1.4.0-11ubuntu2.1 | USN-5825-2, USN-5825-1 |
| Ubuntu 20.04 LTS | pam | 1.3.1-5ubuntu4.4 | USN-5825-2, USN-5825-1 |
| Ubuntu 18.04 LTS | pam | 1.1.8-3.6ubuntu2.18.04.4 | USN-5825-2, USN-5825-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | pam | 1.1.8-3.2ubuntu2.3+esm2 | USN-5825-2, USN-5825-1 |
| Ubuntu Pro 14.04 LTS | pam | 1.1.8-1ubuntu2.2+esm1 | USN-5825-2, USN-5825-1 |
Advisories 4
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- USN-5825-1 pam vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-5825-2 pam regressions Ubuntu Security Notices (USN) · Jun 29, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025