CVE-2022-28321
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for...
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
- Record
CVE-2022-28321- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
- Record
CVE-2022-28321- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2022-32773
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
- Record
EUVD-2022-32773- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p9vf-jjj8-m5r9
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for...
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
- Record
GHSA-p9vf-jjj8-m5r9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287, CWE-863
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-28321
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
- Record
UBUNTU-CVE-2022-28321- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2023-1675111190 No score
Fix CVE(s): CVE-2022-28321
- SECURITY UPDATE: access denial bypass in pam_access.so
- debian/patches-applied/CVE-2022-28321.patch: properly use getnameinfo() and getaddrinfo() to handle hostnames in access.conf, add freeaddrinfo() to avoid memory leaks on return from network_netmask_match() as well
- CVE-2022-28321
- Record
CLSA-2023-1675111190- Updated
- 2026-11-02
OSVUSN-5825-1 No score
pam vulnerability
It was discovered that PAM did not correctly restrict login from an IP address that is not resolvable via DNS. An attacker could possibly use this issue to bypass authentication.
- Record
USN-5825-1- Updated
- 2026-11-02
OSVUSN-5825-2 No score
pam regressions
USN-5825-1 fixed vulnerabilities in PAM. Unfortunately that update was incomplete and could introduce a regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that PAM did not correctly restrict login from an IP address that is not resolvable via DNS. An attacker could possibly use this issue to bypass authentication.
- Record
USN-5825-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libpam-cracklibTuxCare:Ubuntu:16.04 |
before 1.1.8-3.2ubuntu2.3+tuxcare.els1 | 1.1.8-3.2ubuntu2.3+tuxcare.els1 |
libpam-docTuxCare:Ubuntu:16.04 |
before 1.1.8-3.2ubuntu2.3+tuxcare.els1 | 1.1.8-3.2ubuntu2.3+tuxcare.els1 |
libpam-modulesTuxCare:Ubuntu:16.04 |
before 1.1.8-3.2ubuntu2.3+tuxcare.els1 | 1.1.8-3.2ubuntu2.3+tuxcare.els1 |
libpam-modules-binTuxCare:Ubuntu:16.04 |
before 1.1.8-3.2ubuntu2.3+tuxcare.els1 | 1.1.8-3.2ubuntu2.3+tuxcare.els1 |
libpam-runtimeTuxCare:Ubuntu:16.04 |
before 1.1.8-3.2ubuntu2.3+tuxcare.els1 | 1.1.8-3.2ubuntu2.3+tuxcare.els1 |
libpam0gTuxCare:Ubuntu:16.04 |
before 1.1.8-3.2ubuntu2.3+tuxcare.els1 | 1.1.8-3.2ubuntu2.3+tuxcare.els1 |
libpam0g-devTuxCare:Ubuntu:16.04 |
before 1.1.8-3.2ubuntu2.3+tuxcare.els1 | 1.1.8-3.2ubuntu2.3+tuxcare.els1 |
pamUbuntu:Pro:14.04:LTS |
before 1.1.8-1ubuntu2.2+esm1, plus listed versions 1.1.3-8ubuntu31.1.3-10ubuntu11.1.3-11ubuntu11.1.8-1ubuntu11.1.8-1ubuntu21.1.8-1ubuntu2.11.1.8-1ubuntu2.2 |
1.1.8-1ubuntu2.2+esm1 |
pamUbuntu:Pro:16.04:LTS |
before 1.1.8-3.2ubuntu2.3+esm2, plus listed versions 1.1.8-3.1ubuntu31.1.8-3.2ubuntu21.1.8-3.2ubuntu2.11.1.8-3.2ubuntu2.31.1.8-3.2ubuntu2.3+esm1 |
1.1.8-3.2ubuntu2.3+esm2 |
pamUbuntu:18.04:LTS |
before 1.1.8-3.6ubuntu2.18.04.4, plus listed versions 1.1.8-3.2ubuntu31.1.8-3.2ubuntu41.1.8-3.6ubuntu11.1.8-3.6ubuntu21.1.8-3.6ubuntu2.18.04.11.1.8-3.6ubuntu2.18.04.21.1.8-3.6ubuntu2.18.04.3 |
1.1.8-3.6ubuntu2.18.04.4 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pamUbuntu:20.04:LTS |
before 1.3.1-5ubuntu4.4, plus listed versions 1.3.1-5ubuntu11.3.1-5ubuntu31.3.1-5ubuntu41.3.1-5ubuntu4.11.3.1-5ubuntu4.21.3.1-5ubuntu4.3 |
1.3.1-5ubuntu4.4 |
pamUbuntu:22.04:LTS |
before 1.4.0-11ubuntu2.1, plus listed versions 1.3.1-5ubuntu111.4.0-10ubuntu11.4.0-10ubuntu21.4.0-11ubuntu11.4.0-11ubuntu2 |
1.4.0-11ubuntu2.1 |
pamUbuntu:Pro:14.04:LTS |
before 1.1.8-1ubuntu2.2+esm3, plus listed versions 1.1.3-8ubuntu31.1.3-10ubuntu11.1.3-11ubuntu11.1.8-1ubuntu11.1.8-1ubuntu21.1.8-1ubuntu2.11.1.8-1ubuntu2.21.1.8-1ubuntu2.2+esm1 |
1.1.8-1ubuntu2.2+esm3 |
pamUbuntu:Pro:16.04:LTS |
before 1.1.8-3.2ubuntu2.3+esm4, plus listed versions 1.1.8-3.1ubuntu31.1.8-3.2ubuntu21.1.8-3.2ubuntu2.11.1.8-3.2ubuntu2.31.1.8-3.2ubuntu2.3+esm11.1.8-3.2ubuntu2.3+esm2 |
1.1.8-3.2ubuntu2.3+esm4 |
pamUbuntu:18.04:LTS |
before 1.1.8-3.6ubuntu2.18.04.6, plus listed versions 1.1.8-3.2ubuntu31.1.8-3.2ubuntu41.1.8-3.6ubuntu11.1.8-3.6ubuntu21.1.8-3.6ubuntu2.18.04.11.1.8-3.6ubuntu2.18.04.21.1.8-3.6ubuntu2.18.04.31.1.8-3.6ubuntu2.18.04.4 |
1.1.8-3.6ubuntu2.18.04.6 |
pamUbuntu:20.04:LTS |
before 1.3.1-5ubuntu4.6, plus listed versions 1.3.1-5ubuntu11.3.1-5ubuntu31.3.1-5ubuntu41.3.1-5ubuntu4.11.3.1-5ubuntu4.21.3.1-5ubuntu4.31.3.1-5ubuntu4.4 |
1.3.1-5ubuntu4.6 |
pamUbuntu:22.04:LTS |
before 1.4.0-11ubuntu2.3, plus listed versions 1.3.1-5ubuntu111.4.0-10ubuntu11.4.0-10ubuntu21.4.0-11ubuntu11.4.0-11ubuntu21.4.0-11ubuntu2.1 |
1.4.0-11ubuntu2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-28321 is a critical vulnerability (CVSS 9.8) in Linux-pam, published September 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.58%, the 75th percentile. Fixed in libpam-cracklib 1.1.8-3.2ubuntu2.3+tuxcare.els1.