{"id":"USN-8688-1","aliases":[],"status":"published","title":"pam vulnerability","description":"Juthawong Naisanguansee discovered that PAM incorrectly cleared failed\nlogin attempt records when certain services invoked the account phase\nwithout first performing authentication. An attacker could possibly use\nthis issue to reset failed login counters, resulting in authentication\nlockout restrictions being bypassed.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-27T19:43:08Z","modified":"2026-08-31T17:16:06Z","fixes":[{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pam","fixed_in":["1.1.8-3.6ubuntu2.18.04.6+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pam","fixed_in":["1.3.1-5ubuntu4.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pam","fixed_in":["1.4.0-11ubuntu2.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"pam","fixed_in":["1.5.3-5ubuntu5.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.6ubuntu2.18.04.6+esm2"}]}],"versions":["1.1.8-3.2ubuntu3","1.1.8-3.2ubuntu4","1.1.8-3.6ubuntu1","1.1.8-3.6ubuntu2","1.1.8-3.6ubuntu2.18.04.1","1.1.8-3.6ubuntu2.18.04.2","1.1.8-3.6ubuntu2.18.04.3","1.1.8-3.6ubuntu2.18.04.4","1.1.8-3.6ubuntu2.18.04.6","1.1.8-3.6ubuntu2.18.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-5ubuntu4.7+esm1"}]}],"versions":["1.3.1-5ubuntu1","1.3.1-5ubuntu3","1.3.1-5ubuntu4","1.3.1-5ubuntu4.1","1.3.1-5ubuntu4.2","1.3.1-5ubuntu4.3","1.3.1-5ubuntu4.4","1.3.1-5ubuntu4.6","1.3.1-5ubuntu4.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-11ubuntu2.8"}]}],"versions":["1.3.1-5ubuntu11","1.4.0-10ubuntu1","1.4.0-10ubuntu2","1.4.0-11ubuntu1","1.4.0-11ubuntu2","1.4.0-11ubuntu2.1","1.4.0-11ubuntu2.3","1.4.0-11ubuntu2.4","1.4.0-11ubuntu2.5","1.4.0-11ubuntu2.6","1.4.0-11ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5ubuntu5.7"}]}],"versions":["1.5.2-6ubuntu1","1.5.2-9.1ubuntu1","1.5.2-9.1ubuntu2","1.5.2-9.1ubuntu3","1.5.3-5ubuntu3","1.5.3-5ubuntu4","1.5.3-5ubuntu5","1.5.3-5ubuntu5.1","1.5.3-5ubuntu5.4","1.5.3-5ubuntu5.5","1.5.3-5ubuntu5.6"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-8688-1","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2164901","tags":["report"]}],"sources":{"osv":[{"id":"USN-8688-1","title":"pam vulnerability","description":"Juthawong Naisanguansee discovered that PAM incorrectly cleared failed\nlogin attempt records when certain services invoked the account phase\nwithout first performing authentication. An attacker could possibly use\nthis issue to reset failed login counters, resulting in authentication\nlockout restrictions being bypassed.","status":"published","published":"2026-08-27T19:43:08Z","modified":"2026-08-31T17:16:06.871331742Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}