{"id":"CVE-2022-28321","aliases":["CLSA-2023-1675111190","EUVD-2022-32773","GHSA-p9vf-jjj8-m5r9","UBUNTU-CVE-2022-28321","USN-5825-1","USN-5825-2"],"status":"published","title":"The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for...","description":"The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01579,"percentile":0.75848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-863"],"published":"2022-09-19T21:10:22Z","modified":"2026-10-14T18:31:34Z","fixes":[{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-cracklib","fixed_in":["1.1.8-3.2ubuntu2.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-doc","fixed_in":["1.1.8-3.2ubuntu2.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-modules","fixed_in":["1.1.8-3.2ubuntu2.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-modules-bin","fixed_in":["1.1.8-3.2ubuntu2.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-runtime","fixed_in":["1.1.8-3.2ubuntu2.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam0g","fixed_in":["1.1.8-3.2ubuntu2.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam0g-dev","fixed_in":["1.1.8-3.2ubuntu2.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pam","fixed_in":["1.1.8-1ubuntu2.2+esm1","1.1.8-1ubuntu2.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pam","fixed_in":["1.1.8-3.2ubuntu2.3+esm2","1.1.8-3.2ubuntu2.3+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"pam","fixed_in":["1.1.8-3.6ubuntu2.18.04.4","1.1.8-3.6ubuntu2.18.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"pam","fixed_in":["1.3.1-5ubuntu4.4","1.3.1-5ubuntu4.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pam","fixed_in":["1.4.0-11ubuntu2.1","1.4.0-11ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-cracklib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.2ubuntu2.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.2ubuntu2.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.2ubuntu2.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-modules-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.2ubuntu2.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.2ubuntu2.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam0g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.2ubuntu2.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam0g-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.2ubuntu2.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-1ubuntu2.2+esm1"}]}],"versions":["1.1.3-8ubuntu3","1.1.3-10ubuntu1","1.1.3-11ubuntu1","1.1.8-1ubuntu1","1.1.8-1ubuntu2","1.1.8-1ubuntu2.1","1.1.8-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.2ubuntu2.3+esm2"}]}],"versions":["1.1.8-3.1ubuntu3","1.1.8-3.2ubuntu2","1.1.8-3.2ubuntu2.1","1.1.8-3.2ubuntu2.3","1.1.8-3.2ubuntu2.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.6ubuntu2.18.04.4"}]}],"versions":["1.1.8-3.2ubuntu3","1.1.8-3.2ubuntu4","1.1.8-3.6ubuntu1","1.1.8-3.6ubuntu2","1.1.8-3.6ubuntu2.18.04.1","1.1.8-3.6ubuntu2.18.04.2","1.1.8-3.6ubuntu2.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-5ubuntu4.4"}]}],"versions":["1.3.1-5ubuntu1","1.3.1-5ubuntu3","1.3.1-5ubuntu4","1.3.1-5ubuntu4.1","1.3.1-5ubuntu4.2","1.3.1-5ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-11ubuntu2.1"}]}],"versions":["1.3.1-5ubuntu11","1.4.0-10ubuntu1","1.4.0-10ubuntu2","1.4.0-11ubuntu1","1.4.0-11ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-1ubuntu2.2+esm1"}]}],"versions":["1.1.3-8ubuntu3","1.1.3-10ubuntu1","1.1.3-11ubuntu1","1.1.8-1ubuntu1","1.1.8-1ubuntu2","1.1.8-1ubuntu2.1","1.1.8-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.2ubuntu2.3+esm2"}]}],"versions":["1.1.8-3.1ubuntu3","1.1.8-3.2ubuntu2","1.1.8-3.2ubuntu2.1","1.1.8-3.2ubuntu2.3","1.1.8-3.2ubuntu2.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.6ubuntu2.18.04.4"}]}],"versions":["1.1.8-3.2ubuntu3","1.1.8-3.2ubuntu4","1.1.8-3.6ubuntu1","1.1.8-3.6ubuntu2","1.1.8-3.6ubuntu2.18.04.1","1.1.8-3.6ubuntu2.18.04.2","1.1.8-3.6ubuntu2.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-5ubuntu4.4"}]}],"versions":["1.3.1-5ubuntu1","1.3.1-5ubuntu3","1.3.1-5ubuntu4","1.3.1-5ubuntu4.1","1.3.1-5ubuntu4.2","1.3.1-5ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-11ubuntu2.1"}]}],"versions":["1.3.1-5ubuntu11","1.4.0-10ubuntu1","1.4.0-10ubuntu2","1.4.0-11ubuntu1","1.4.0-11ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-1ubuntu2.2+esm3"}]}],"versions":["1.1.3-8ubuntu3","1.1.3-10ubuntu1","1.1.3-11ubuntu1","1.1.8-1ubuntu1","1.1.8-1ubuntu2","1.1.8-1ubuntu2.1","1.1.8-1ubuntu2.2","1.1.8-1ubuntu2.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.2ubuntu2.3+esm4"}]}],"versions":["1.1.8-3.1ubuntu3","1.1.8-3.2ubuntu2","1.1.8-3.2ubuntu2.1","1.1.8-3.2ubuntu2.3","1.1.8-3.2ubuntu2.3+esm1","1.1.8-3.2ubuntu2.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.6ubuntu2.18.04.6"}]}],"versions":["1.1.8-3.2ubuntu3","1.1.8-3.2ubuntu4","1.1.8-3.6ubuntu1","1.1.8-3.6ubuntu2","1.1.8-3.6ubuntu2.18.04.1","1.1.8-3.6ubuntu2.18.04.2","1.1.8-3.6ubuntu2.18.04.3","1.1.8-3.6ubuntu2.18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-5ubuntu4.6"}]}],"versions":["1.3.1-5ubuntu1","1.3.1-5ubuntu3","1.3.1-5ubuntu4","1.3.1-5ubuntu4.1","1.3.1-5ubuntu4.2","1.3.1-5ubuntu4.3","1.3.1-5ubuntu4.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-11ubuntu2.3"}]}],"versions":["1.3.1-5ubuntu11","1.4.0-10ubuntu1","1.4.0-10ubuntu2","1.4.0-11ubuntu1","1.4.0-11ubuntu2","1.4.0-11ubuntu2.1"]}],"products":[{"vendor":"linux-pam","product":"linux-pam"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"http://download.opensuse.org/source/distribution/openSUSE-current/repo/oss/src/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28321.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1197654","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28321"},{"url":"http://download.opensuse.org/source/distribution/openSUSE-current/repo/oss/src"},{"url":"https://github.com/advisories/GHSA-p9vf-jjj8-m5r9"},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2023-1675111190","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-28321","tags":["report"]},{"url":"https://github.com/linux-pam/linux-pam/pull/447","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5825-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5825-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28321","tags":["report"]},{"url":"https://launchpad.net/bugs/2006073","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-28321","description":"The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.","status":"published","published":"2022-09-19T21:10:22Z","modified":"2026-10-14T16:29:15.106Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-32773","description":"The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.","status":"published","published":"2022-09-19T21:10:22Z","modified":"2026-10-14T16:29:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:14.304159Z"}],"ghsa":[{"id":"GHSA-p9vf-jjj8-m5r9","title":"The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for...","description":"The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.","status":"published","published":"2022-09-20T00:00:21Z","modified":"2026-10-14T18:31:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287","CWE-863"],"updated_at":"2026-11-02T15:13:26.734116Z"}],"nvd":[{"id":"CVE-2022-28321","description":"The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.","status":"published","published":"2022-09-19T22:15:10.913Z","modified":"2026-10-14T17:17:38.04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:28.118799Z"}],"osv":[{"id":"UBUNTU-CVE-2022-28321","description":"The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.","status":"published","published":"2022-09-19T22:15:00Z","modified":"2026-04-22T13:21:22.153906Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CLSA-2023-1675111190","title":"Fix CVE(s): CVE-2022-28321","description":"\n   * SECURITY UPDATE: access denial bypass in pam_access.so\n     - debian/patches-applied/CVE-2022-28321.patch: properly use getnameinfo()\n       and getaddrinfo() to handle hostnames in access.conf, add freeaddrinfo()\n       to avoid memory leaks on return from network_netmask_match() as well\n     - CVE-2022-28321","status":"published","published":"2023-01-30T20:39:50Z","modified":"2026-06-04T10:03:16.406899Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"USN-5825-1","title":"pam vulnerability","description":"It was discovered that PAM did not correctly restrict login from an IP\naddress that is not resolvable via DNS. An attacker could possibly use this\nissue to bypass authentication.\n","status":"published","published":"2023-01-25T09:38:40Z","modified":"2026-06-29T13:50:45.685574545Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-5825-2","title":"pam regressions","description":"USN-5825-1 fixed vulnerabilities in PAM. Unfortunately that update was\nincomplete and could introduce a regression. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that PAM did not correctly restrict login from an IP\n address that is not resolvable via DNS. An attacker could possibly use this\n issue to bypass authentication.\n","status":"published","published":"2023-02-06T03:06:11Z","modified":"2026-06-29T13:50:45.25873803Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}