Vulnerabilidades do Linux-PAM Linux-PAM
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Linux-PAM Linux-PAM: 3 registro(s), com versões afetadas e correções.
CVE-2026-54411
Média · 5.9
CWE-208 14/06/2026
Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.
CVE-2024-22365
Média · 5.5
CWE-664 06/02/2024
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked...
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
CVE-2022-28321
Crítica · 9.8
CWE-287 19/09/2022
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for...
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.