libpam0g: The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins
CVE-2022-28321 is fixed in 5 products on 1 platform, first by libpam-cracklib 1.1.8-3.6ubuntu2.18.04.4, released September 19, 2022. It is not reported as exploited. Patch Radar priority: Routine.
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libpam-cracklib · Ubuntu 18.04.6 LTS (bionic) | 1.1.8-3.6ubuntu2.18.04.4 | libpam-cracklib 1.1.8-3.6ubuntu2.18.04.4 | Sep 19, 2022 |
| libpam-cracklib · Ubuntu 20.04 LTS (focal) | 1.3.1-5ubuntu4.4 | libpam-cracklib 1.3.1-5ubuntu4.4 | Sep 19, 2022 |
| libpam-cracklib · Ubuntu 22.04.1 LTS (jammy) | 1.4.0-11ubuntu2.1 | libpam-cracklib 1.4.0-11ubuntu2.1 | Sep 19, 2022 |
| libpam-modules · Ubuntu 18.04.6 LTS (bionic) | 1.1.8-3.6ubuntu2.18.04.4 | libpam-modules 1.1.8-3.6ubuntu2.18.04.4 | Sep 19, 2022 |
| libpam-modules · Ubuntu 20.04 LTS (focal) | 1.3.1-5ubuntu4.4 | libpam-modules 1.3.1-5ubuntu4.4 | Sep 19, 2022 |
| libpam-modules · Ubuntu 22.04.1 LTS (jammy) | 1.4.0-11ubuntu2.1 | libpam-modules 1.4.0-11ubuntu2.1 | Sep 19, 2022 |
| libpam-modules-bin · Ubuntu 18.04.6 LTS (bionic) | 1.1.8-3.6ubuntu2.18.04.4 | libpam-modules-bin 1.1.8-3.6ubuntu2.18.04.4 | Sep 19, 2022 |
| libpam-modules-bin · Ubuntu 20.04 LTS (focal) | 1.3.1-5ubuntu4.4 | libpam-modules-bin 1.3.1-5ubuntu4.4 | Sep 19, 2022 |
| libpam-modules-bin · Ubuntu 22.04.1 LTS (jammy) | 1.4.0-11ubuntu2.1 | libpam-modules-bin 1.4.0-11ubuntu2.1 | Sep 19, 2022 |
| libpam-runtime · Ubuntu 18.04.6 LTS (bionic) | 1.1.8-3.6ubuntu2.18.04.4 | libpam-runtime 1.1.8-3.6ubuntu2.18.04.4 | Sep 19, 2022 |
| libpam-runtime · Ubuntu 20.04 LTS (focal) | 1.3.1-5ubuntu4.4 | libpam-runtime 1.3.1-5ubuntu4.4 | Sep 19, 2022 |
| libpam-runtime · Ubuntu 22.04.1 LTS (jammy) | 1.4.0-11ubuntu2.1 | libpam-runtime 1.4.0-11ubuntu2.1 | Sep 19, 2022 |
| libpam0g · Ubuntu 18.04.6 LTS (bionic) | 1.1.8-3.6ubuntu2.18.04.4 | libpam0g 1.1.8-3.6ubuntu2.18.04.4 | Sep 19, 2022 |
| libpam0g · Ubuntu 20.04 LTS (focal) | 1.3.1-5ubuntu4.4 | libpam0g 1.3.1-5ubuntu4.4 | Sep 19, 2022 |
| libpam0g · Ubuntu 22.04.1 LTS (jammy) | 1.4.0-11ubuntu2.1 | libpam0g 1.4.0-11ubuntu2.1 | Sep 19, 2022 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.