{"id":"CVE-2026-54411","aliases":["ALSA-2026:56131","ALSA-2026:59379","ALSA-2026:64815","AZL-90093","CLSA-2026-1788971665","CLSA-2026-1789472351","DEBIAN-CVE-2026-54411","EUVD-2026-36662","GHSA-56gg-22rq-q53x","MGASA-2026-0461","OESA-2026-2900","OESA-2026-2901","OESA-2026-2902","OESA-2026-2903","OESA-2026-3008","RHSA-2026:35016","RHSA-2026:56131","RHSA-2026:59379","RHSA-2026:60224","RHSA-2026:61223","RHSA-2026:61224","RHSA-2026:61225","RHSA-2026:61226","RHSA-2026:61227","RHSA-2026:61228","RHSA-2026:61229","RHSA-2026:61230","RHSA-2026:64815","RHSA-2026:7553","RLSA-2026:56131","RLSA-2026:59379","RLSA-2026:64815","ROOT-OS-DEBIAN-11-CVE-2026-54411","ROOT-OS-DEBIAN-12-CVE-2026-54411","ROOT-OS-DEBIAN-13-CVE-2026-54411","SUSE-SU-2026:22599-1","SUSE-SU-2026:22639-1","SUSE-SU-2026:22807-1","SUSE-SU-2026:22896-1","SUSE-SU-2026:3162-1","SUSE-SU-2026:3163-1","UBUNTU-CVE-2026-54411","USN-8601-1","openSUSE-SU-2026:11201-1","openSUSE-SU-2026:21320-1"],"status":"published","title":"Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0032,"percentile":0.25395,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2026-06-14T17:21:43Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"pam","fixed_in":["1.3.1-40.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pam-devel","fixed_in":["1.3.1-40.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pam","fixed_in":["1.6.1-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pam-devel","fixed_in":["1.6.1-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pam-libs","fixed_in":["1.6.1-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pam","fixed_in":["1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pam-devel","fixed_in":["1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pam-docs","fixed_in":["1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"pam","fixed_in":["1.5.3-5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"pam","fixed_in":["1.5.1-14.el9.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"pam-devel","fixed_in":["1.5.1-14.el9.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"pam-docs","fixed_in":["1.5.1-14.el9.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"pam","fixed_in":["1.5.1-26.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"pam-devel","fixed_in":["1.5.1-26.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"pam-docs","fixed_in":["1.5.1-26.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"pam","fixed_in":["1.7.1-2.1.mga10"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"pam","fixed_in":["1.4.0-20.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"pam","fixed_in":["1.5.2-17.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"pam","fixed_in":["1.5.3-12.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"pam","fixed_in":["1.5.3-12.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"pam","fixed_in":["1.5.3-12.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"pam","fixed_in":["0:1.7.2-2.2.hum1","0:1.7.2-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"pam-devel","fixed_in":["0:1.7.2-2.2.hum1","0:1.7.2-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"pam-doc","fixed_in":["0:1.7.2-2.2.hum1","0:1.7.2-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"pam-libs","fixed_in":["0:1.7.2-2.2.hum1","0:1.7.2-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam","fixed_in":["0:1.3.1-40.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam-debuginfo","fixed_in":["0:1.3.1-40.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam-debugsource","fixed_in":["0:1.3.1-40.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam-devel","fixed_in":["0:1.3.1-40.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam-debuginfo","fixed_in":["0:1.6.1-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam-debugsource","fixed_in":["0:1.6.1-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam-devel","fixed_in":["0:1.6.1-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam-libs-debuginfo","fixed_in":["0:1.6.1-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam","fixed_in":["0:1.6.1-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam-libs","fixed_in":["0:1.6.1-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-debuginfo","fixed_in":["0:1.5.1-27.el9_8.1","0:1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-debugsource","fixed_in":["0:1.5.1-27.el9_8.1","0:1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-devel","fixed_in":["0:1.5.1-27.el9_8.1","0:1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-docs","fixed_in":["0:1.5.1-27.el9_8.1","0:1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam","fixed_in":["0:1.5.1-27.el9_8.1","0:1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam-debuginfo","fixed_in":["0:1.5.1-27.el9_8.1","0:1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam-debugsource","fixed_in":["0:1.5.1-27.el9_8.1","0:1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"pam","fixed_in":["0:1.3.1-16.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"pam-debuginfo","fixed_in":["0:1.3.1-16.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"pam-debugsource","fixed_in":["0:1.3.1-16.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"pam-devel","fixed_in":["0:1.3.1-16.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"pam","fixed_in":["0:1.3.1-16.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"pam-debuginfo","fixed_in":["0:1.3.1-16.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"pam-debugsource","fixed_in":["0:1.3.1-16.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"pam-devel","fixed_in":["0:1.3.1-16.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"pam","fixed_in":["0:1.3.1-14.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"pam-debuginfo","fixed_in":["0:1.3.1-14.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"pam-debugsource","fixed_in":["0:1.3.1-14.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"pam-devel","fixed_in":["0:1.3.1-14.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"pam","fixed_in":["0:1.3.1-14.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"pam-debuginfo","fixed_in":["0:1.3.1-14.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"pam-debugsource","fixed_in":["0:1.3.1-14.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"pam-devel","fixed_in":["0:1.3.1-14.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"pam","fixed_in":["0:1.3.1-26.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"pam-debuginfo","fixed_in":["0:1.3.1-26.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"pam-debugsource","fixed_in":["0:1.3.1-26.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"pam-devel","fixed_in":["0:1.3.1-26.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"pam","fixed_in":["0:1.3.1-26.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"pam-debuginfo","fixed_in":["0:1.3.1-26.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"pam-debugsource","fixed_in":["0:1.3.1-26.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"pam-devel","fixed_in":["0:1.3.1-26.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"pam-debuginfo","fixed_in":["0:1.5.1-15.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"pam-debugsource","fixed_in":["0:1.5.1-15.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"pam-devel","fixed_in":["0:1.5.1-15.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"pam-docs","fixed_in":["0:1.5.1-15.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"pam","fixed_in":["0:1.5.1-15.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"pam-debuginfo","fixed_in":["0:1.5.1-15.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"pam-debugsource","fixed_in":["0:1.5.1-15.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"pam","fixed_in":["0:1.1.8-23.el7_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"pam-debuginfo","fixed_in":["0:1.1.8-23.el7_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"pam-devel","fixed_in":["0:1.1.8-23.el7_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"pam-debuginfo","fixed_in":["0:1.5.1-24.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"pam-debugsource","fixed_in":["0:1.5.1-24.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"pam-devel","fixed_in":["0:1.5.1-24.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"pam-docs","fixed_in":["0:1.5.1-24.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"pam","fixed_in":["0:1.5.1-24.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"pam-debuginfo","fixed_in":["0:1.5.1-24.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"pam-debugsource","fixed_in":["0:1.5.1-24.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam-debuginfo","fixed_in":["0:1.6.1-8.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam-debugsource","fixed_in":["0:1.6.1-8.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam-devel","fixed_in":["0:1.6.1-8.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam-libs-debuginfo","fixed_in":["0:1.6.1-8.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam","fixed_in":["0:1.6.1-8.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam-libs","fixed_in":["0:1.6.1-8.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"pam-debuginfo","fixed_in":["0:1.5.1-26.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"pam-debugsource","fixed_in":["0:1.5.1-26.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"pam-devel","fixed_in":["0:1.5.1-26.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"pam-docs","fixed_in":["0:1.5.1-26.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"pam","fixed_in":["0:1.5.1-26.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"pam-debuginfo","fixed_in":["0:1.5.1-26.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"pam-debugsource","fixed_in":["0:1.5.1-26.el9_6.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pam","fixed_in":["0:1.3.1-40.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"pam","fixed_in":["0:1.6.1-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"pam","fixed_in":["0:1.5.1-28.el9_8.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"pam","fixed_in":["1.4.0-9+deb11u2.aikido.9","1.4.0-9+deb11u2.root.io.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-pam","fixed_in":["1.4.0-9+deb11u2.aikido.9","1.4.0-9+deb11u2.root.io.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"pam","fixed_in":["1.5.2-6+deb12u2.root.io.16","1.5.2-6+deb12u2.aikido.17"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-pam","fixed_in":["1.5.2-6+deb12u2.root.io.16","1.5.2-6+deb12u2.aikido.17"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"pam","fixed_in":["1.7.0-5.aikido.2","1.7.0-5.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-pam","fixed_in":["1.7.0-5.aikido.2","1.7.0-5.root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"pam","fixed_in":["1.7.1-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"pam-full-src","fixed_in":["1.7.1-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"pam","fixed_in":["1.7.1-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"pam-full-src","fixed_in":["1.7.1-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"pam","fixed_in":["1.7.1-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"pam-full-src","fixed_in":["1.7.1-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"pam","fixed_in":["1.6.0-6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"pam","fixed_in":["1.6.1-slfo.1.1_5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"pam","fixed_in":["1.1.8-24.80.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"pam","fixed_in":["1.3.0-150000.6.89.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"pam","fixed_in":["1.3.0-150000.6.89.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"pam","fixed_in":["1.3.0-150000.6.89.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"pam","fixed_in":["1.3.0-150000.6.89.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"pam","fixed_in":["1.3.0-150000.6.89.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pam","fixed_in":["1.4.0-11ubuntu2.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"pam","fixed_in":["1.5.3-5ubuntu5.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"pam","fixed_in":["1.7.0-5ubuntu3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"pam","fixed_in":["1.7.2+git12-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"pam","fixed_in":["1.7.1-160000.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"pam-full-src","fixed_in":["1.7.1-160000.5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-40.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-40.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pam-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-14.el9.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-14.el9.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-14.el9.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-26.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-26.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-26.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-6","1.5.2-6+deb12u1","1.5.2-6+deb12u2","1.5.2-7","1.5.2-8","1.5.2-9","1.5.2-9.1","1.5.3-1","1.5.3-2","1.5.3-3","1.5.3-4","1.5.3-5","1.5.3-6","1.5.3-6+hurd.1","1.5.3-7","1.7.0-1","1.7.0-2","1.7.0-2+hurd.1","1.7.0-3","1.7.0-4","1.7.0-5","1.7.0-6","1.7.0-7","1.7.0-8"]},{"source":"osv","ecosystem":"Debian:13","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-5","1.7.0-6","1.7.0-7","1.7.0-8"]},{"source":"osv","ecosystem":"Debian:14","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-5","1.7.0-6","1.7.0-7","1.7.0-8"]},{"source":"osv","ecosystem":"Mageia:10","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-2.1.mga10"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-20.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-17.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-12.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-12.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-12.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-2.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-2.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pam-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-2.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pam-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-2.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-40.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-40.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-40.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-40.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"pam-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-27.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-27.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-27.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-27.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-27.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-27.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-27.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-16.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-16.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-16.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-16.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-16.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-16.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-16.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-16.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-14.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-14.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-14.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-14.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-14.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-14.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-14.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-14.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-26.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-26.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-26.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-26.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-26.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-26.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-26.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-26.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-15.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-15.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-15.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"pam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-15.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-15.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-15.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-15.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-23.el7_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-23.el7_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-23.el7_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-24.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-24.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-24.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"pam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-24.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-24.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-24.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-24.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-8.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-8.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-8.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-8.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-8.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"pam-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-8.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-26.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-26.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-26.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"pam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-26.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-26.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-26.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-26.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pam-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pam-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-40.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-28.el9_8.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-9+deb11u2.aikido.9"},{"fixed":"1.4.0-9+deb11u2.root.io.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-9+deb11u2.aikido.9"},{"fixed":"1.4.0-9+deb11u2.root.io.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-6+deb12u2.root.io.16"},{"fixed":"1.5.2-6+deb12u2.aikido.17"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-6+deb12u2.root.io.16"},{"fixed":"1.5.2-6+deb12u2.aikido.17"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-5.aikido.2"},{"fixed":"1.7.0-5.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-5.aikido.2"},{"fixed":"1.7.0-5.root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"pam-full-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"pam-full-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"pam-full-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-slfo.1.1_5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-24.80.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-150000.6.89.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-150000.6.89.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-150000.6.89.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-150000.6.89.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-150000.6.89.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-8ubuntu3","1.1.3-10ubuntu1","1.1.3-11ubuntu1","1.1.8-1ubuntu1","1.1.8-1ubuntu2","1.1.8-1ubuntu2.1","1.1.8-1ubuntu2.2","1.1.8-1ubuntu2.2+esm1","1.1.8-1ubuntu2.2+esm3","1.1.8-1ubuntu2.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-3.1ubuntu3","1.1.8-3.2ubuntu2","1.1.8-3.2ubuntu2.1","1.1.8-3.2ubuntu2.3","1.1.8-3.2ubuntu2.3+esm1","1.1.8-3.2ubuntu2.3+esm2","1.1.8-3.2ubuntu2.3+esm4","1.1.8-3.2ubuntu2.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-3.2ubuntu3","1.1.8-3.2ubuntu4","1.1.8-3.6ubuntu1","1.1.8-3.6ubuntu2","1.1.8-3.6ubuntu2.18.04.1","1.1.8-3.6ubuntu2.18.04.2","1.1.8-3.6ubuntu2.18.04.3","1.1.8-3.6ubuntu2.18.04.4","1.1.8-3.6ubuntu2.18.04.6","1.1.8-3.6ubuntu2.18.04.6+esm1","1.1.8-3.6ubuntu2.18.04.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.1-5ubuntu1","1.3.1-5ubuntu3","1.3.1-5ubuntu4","1.3.1-5ubuntu4.1","1.3.1-5ubuntu4.2","1.3.1-5ubuntu4.3","1.3.1-5ubuntu4.4","1.3.1-5ubuntu4.6","1.3.1-5ubuntu4.7","1.3.1-5ubuntu4.7+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-11ubuntu2.7"}]}],"versions":["1.3.1-5ubuntu11","1.4.0-10ubuntu1","1.4.0-10ubuntu2","1.4.0-11ubuntu1","1.4.0-11ubuntu2","1.4.0-11ubuntu2.1","1.4.0-11ubuntu2.3","1.4.0-11ubuntu2.4","1.4.0-11ubuntu2.5","1.4.0-11ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5ubuntu5.6"}]}],"versions":["1.5.2-6ubuntu1","1.5.2-9.1ubuntu1","1.5.2-9.1ubuntu2","1.5.2-9.1ubuntu3","1.5.3-5ubuntu3","1.5.3-5ubuntu4","1.5.3-5ubuntu5","1.5.3-5ubuntu5.1","1.5.3-5ubuntu5.4","1.5.3-5ubuntu5.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3-7ubuntu4","1.5.3-7ubuntu5","1.5.3-7ubuntu6","1.7.0-5ubuntu1","1.7.0-5ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-5ubuntu3.1"}]}],"versions":["1.7.0-5ubuntu2","1.7.0-5ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-11ubuntu2.7"}]}],"versions":["1.3.1-5ubuntu11","1.4.0-10ubuntu1","1.4.0-10ubuntu2","1.4.0-11ubuntu1","1.4.0-11ubuntu2","1.4.0-11ubuntu2.1","1.4.0-11ubuntu2.3","1.4.0-11ubuntu2.4","1.4.0-11ubuntu2.5","1.4.0-11ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5ubuntu5.6"}]}],"versions":["1.5.2-6ubuntu1","1.5.2-9.1ubuntu1","1.5.2-9.1ubuntu2","1.5.2-9.1ubuntu3","1.5.3-5ubuntu3","1.5.3-5ubuntu4","1.5.3-5ubuntu5","1.5.3-5ubuntu5.1","1.5.3-5ubuntu5.4","1.5.3-5ubuntu5.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-5ubuntu3.1"}]}],"versions":["1.7.0-5ubuntu2","1.7.0-5ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2+git12-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"pam-full-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.5.1"}]}]}],"products":[{"vendor":"linux-pam","product":"linux-pam"}],"references":[{"url":"https://github.com/linux-pam/linux-pam","tags":["product","package","article"]},{"url":"https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327","tags":["product","web","article"]},{"url":"https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","tags":["product","web","article"]},{"url":"https://cwe.mitre.org/data/definitions/208.html","tags":["technical-description","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-56gg-22rq-q53x"},{"url":"https://access.redhat.com/errata/RHSA-2026:56131","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54411","tags":["report"]},{"url":"https://bugzilla.redhat.com/2488766","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-56131.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59379","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-59379.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:64815","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-64815.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788971665.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789472351.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54411.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54411","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0461.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35881","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5OKVWSDQUM4BD3D4IPRSS2LJPLO2SRH/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8601-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2900","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2901","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2902","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2903","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3008","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:35016","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35016.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488766","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54411","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56131.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59379.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60224","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60224.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61223","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61223.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61224","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61224.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61225","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61225.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61226","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61226.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61227","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61227.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61228","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61228.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61229","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61229.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61230","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61230.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64815.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7553","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7553.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:56131","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:59379","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:64815","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622599-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268290","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54411","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622639-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622807-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622896-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263162-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263163-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-54411","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-54411","title":"Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.","status":"published","published":"2026-06-14T17:21:43.853Z","modified":"2026-08-10T11:43:56.355Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D","level":"medium","assessor":"cna"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-36662","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.","status":"published","published":"2026-06-14T17:21:43Z","modified":"2026-08-10T11:43:56Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D","level":"medium"}],"updated_at":"2026-11-02T18:02:06.086083Z"}],"ghsa":[{"id":"GHSA-56gg-22rq-q53x","title":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb...","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.","status":"published","published":"2026-06-14T18:32:35Z","modified":"2026-06-14T18:32:41Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:08:45.788743Z"}],"nvd":[{"id":"CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.","status":"published","published":"2026-06-14T18:17:20.587Z","modified":"2026-08-10T12:17:17.103Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"CVE-2026-54411","title":"Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.","status":"published","published":"2026-06-14T17:21:43.853Z","modified":"2026-10-28T02:31:04.163085375Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.","status":"published","published":"2026-06-14T18:17:20.587Z","modified":"2026-10-01T03:03:26.627166836Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"OESA-2026-2900","title":"pam security update","description":"PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.\r\n\r\nSecurity Fix(es):\n\nLinux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module\u0026apos;s plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate\u0026apos;s length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.(CVE-2026-54411)","status":"published","published":"2026-07-09T11:11:48Z","modified":"2026-08-18T01:21:15.20585528Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2901","title":"pam security update","description":"PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.\r\n\r\nSecurity Fix(es):\n\nLinux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module\u0026apos;s plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate\u0026apos;s length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.(CVE-2026-54411)","status":"published","published":"2026-07-09T11:11:48Z","modified":"2026-08-18T01:21:15.390417922Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2902","title":"pam security update","description":"PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.\r\n\r\nSecurity Fix(es):\n\nLinux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module\u0026apos;s plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate\u0026apos;s length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.(CVE-2026-54411)","status":"published","published":"2026-07-09T11:11:48Z","modified":"2026-08-18T01:21:15.158486452Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2903","title":"pam security update","description":"PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.\r\n\r\nSecurity Fix(es):\n\nLinux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module\u0026apos;s plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate\u0026apos;s length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.(CVE-2026-54411)","status":"published","published":"2026-07-09T11:11:48Z","modified":"2026-08-18T01:21:15.059847229Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3008","title":"pam security update","description":"PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.\r\n\r\nSecurity Fix(es):\n\nLinux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module\u0026apos;s plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate\u0026apos;s length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.(CVE-2026-54411)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.194067698Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:35016","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-03T10:13:59Z","modified":"2026-10-14T10:18:13Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:56131","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-19T10:22:54Z","modified":"2026-10-14T10:23:44Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59379","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-26T10:18:09Z","modified":"2026-10-14T10:24:39Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:60224","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-27T10:16:05Z","modified":"2026-10-14T10:24:54Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61223","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-31T10:11:54Z","modified":"2026-10-14T10:25:08Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61224","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-31T10:11:55Z","modified":"2026-10-14T10:25:09Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61225","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-31T10:11:55Z","modified":"2026-10-14T10:25:09Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61226","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-31T10:11:56Z","modified":"2026-10-14T10:25:10Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61227","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-31T10:11:57Z","modified":"2026-10-14T10:25:10Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61228","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-31T10:11:57Z","modified":"2026-10-14T10:25:11Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61229","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-31T10:11:57Z","modified":"2026-10-14T10:25:12Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61230","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-08-31T10:11:58Z","modified":"2026-10-14T10:25:12Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:64815","title":"Red Hat Security Advisory: pam security update","status":"published","published":"2026-09-08T10:19:16Z","modified":"2026-10-14T10:26:20Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:7553","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-25T10:46:36Z","modified":"2026-10-14T10:30:25Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:56131","title":"Moderate: pam security update","description":"Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.\n\nSecurity Fix(es):\n\n* linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-19T06:01:07.331619Z","modified":"2026-08-19T06:30:04.255327353Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:59379","title":"Moderate: pam security update","description":"Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.\n\nSecurity Fix(es):\n\n* linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-26T12:08:23.18754Z","modified":"2026-08-26T12:30:04.31289824Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:64815","title":"Moderate: pam security update","description":"Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.\n\nSecurity Fix(es):\n\n* linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE age(s)\nlisted in the References section.","status":"published","published":"2026-09-09T12:05:17.368443Z","modified":"2026-09-09T12:30:02.585086239Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.","status":"published","published":"2026-06-14T18:17:00Z","modified":"2026-08-31T17:16:31.932897957Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ALSA-2026:56131","title":"Moderate: pam security update","description":"Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.  \n\nSecurity Fix(es):  \n\n  * linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-18T00:00:00Z","modified":"2026-10-29T11:02:26.387801448Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:59379","title":"Moderate: pam security update","description":"Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.  \n\nSecurity Fix(es):  \n\n  * linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-25T00:00:00Z","modified":"2026-10-29T11:30:46.791965519Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:64815","title":"Moderate: pam security update","description":"Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.  \n\nSecurity Fix(es):  \n\n  * linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE age(s)  \nlisted in the References section.\n","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-10-29T11:32:37.327096134Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-90093","title":"CVE-2026-54411 affecting package pam for versions less than 1.5.3-5","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.","status":"published","published":"2026-06-14T18:17:20Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1788971665","title":"pam: Fix of CVE-2026-54411","description":"- CVE-2026-54411: pam_userdb: observable timing discrepancy in the\n  plaintext password comparison path allowed recovery of the stored\n  password's length and prefix bytes (CWE-208)","status":"published","published":"2026-09-09T16:34:36Z","modified":"2026-10-26T09:30:46.670453278Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789472351","title":"pam: Fix of CVE-2026-54411","description":"- CVE-2026-54411: pam_userdb: observable timing discrepancy in the\n  plaintext password comparison path allowed recovery of the stored\n  password's length and prefix bytes (CWE-208)","status":"published","published":"2026-09-15T11:39:20Z","modified":"2026-10-26T09:31:32.360623294Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"MGASA-2026-0461","title":"Updated pam packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\nLinux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password\nComparison. (CVE-2026-54411)\n","status":"published","published":"2026-09-28T17:04:04Z","modified":"2026-09-28T17:15:05.790770155Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11201-1","title":"pam-1.7.2+git12-2.1 on GA media","description":"These are all security issues fixed in the pam-1.7.2+git12-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-07-09T10:00:07.396568933Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21320-1","title":"Security update for pam","description":"This update for pam fixes the following issue\n\n- CVE-2026-54411: timing discrepancy in the `pam_userdb` module's plaintext-password comparison (bsc#1268290).\n","status":"published","published":"2026-07-13T13:54:55Z","modified":"2026-07-15T18:24:13.520611726Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-54411","title":"CVE-2026-54411 in pam - Patched by Root","description":"Root has patched CVE-2026-54411 in the pam package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T08:20:17Z","modified":"2026-08-23T10:15:22.620205559Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-54411","title":"CVE-2026-54411 in pam - Patched by Root","description":"Root has patched CVE-2026-54411 in the pam package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T14:02:52Z","modified":"2026-08-26T01:13:57.975312163Z","updated_at":"2026-11-02T15:53:32.298225Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-54411","title":"CVE-2026-54411 in pam - Patched by Root","description":"Root has patched CVE-2026-54411 in the pam package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-24T16:29:11Z","modified":"2026-08-24T18:45:20.996644572Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:22599-1","title":"Security update for pam","description":"This update for pam fixes the following issue\n\n- CVE-2026-54411: timing discrepancy in the `pam_userdb` module's plaintext-password comparison (bsc#1268290).\n","status":"published","published":"2026-07-13T13:52:22Z","modified":"2026-07-16T18:24:38.130229912Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22639-1","title":"Security update for pam","description":"This update for pam fixes the following issue\n\n- CVE-2026-54411: timing discrepancy in the `pam_userdb` module's plaintext-password comparison (bsc#1268290).\n","status":"published","published":"2026-07-13T13:52:22Z","modified":"2026-07-17T18:24:04.130014449Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22807-1","title":"Security update for pam","description":"This update for pam fixes the following issue\n\n- CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).\n","status":"published","published":"2026-07-22T08:38:14Z","modified":"2026-07-28T18:24:06.518570247Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22896-1","title":"Security update for pam","description":"This update for pam fixes the following issue\n\n- CVE-2026-54411: timing discrepancy in the `pam_userdb` module's plaintext-password comparison (bsc#1268290).\n","status":"published","published":"2026-07-22T09:06:40Z","modified":"2026-07-28T18:24:18.647583129Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3162-1","title":"Security update for pam","description":"This update for pam fixes the following issue\n\n- CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).\n","status":"published","published":"2026-07-21T14:50:38Z","modified":"2026-07-22T09:30:06.097818066Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3163-1","title":"Security update for pam","description":"This update for pam fixes the following issue\n\n- CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).\n","status":"published","published":"2026-07-21T14:51:09Z","modified":"2026-07-22T09:30:06.078986766Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8601-1","title":"pam vulnerability","description":"It was discovered that PAM had a timing discrepancy in the pam_userdb\nmodule when comparing plaintext passwords. An attacker could possibly use\nthis issue to obtain sensitive information by measuring response-timing\ndifferences during repeated authentication attempts.","status":"published","published":"2026-07-23T14:49:52Z","modified":"2026-07-24T01:35:02.512249924Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}