Linux-PAM Linux-PAM vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Linux-PAM Linux-PAM: 3 record(s), with affected versions and fixes.
CVE-2026-54411
Medium · 5.9
CWE-208 Jun 14, 2026
Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.
CVE-2024-22365
Medium · 5.5
CWE-664 Feb 6, 2024
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked...
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
CVE-2022-28321
Critical · 9.8
CWE-287 Sep 19, 2022
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for...
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.