Ubuntu alert USN-8688-2 (pam)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8688-2] PAM vulnerability
Date:
             
 
Tue, 01 Sep 2026 17:41:34 +0000
Message-ID:
             
 
<E1x1SUI-00082z-VP@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8688-2
September 01, 2026

pam vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS

Summary:

A system hardening measure could be bypassed.

Software Description:
- pam: Pluggable Authentication Modules

Details:

USN-8688-1 fixed a vulnerability in PAM. This update provides the
corresponding fix for PAM on Ubuntu 26.04 LTS.

Original advisory details:

 Juthawong Naisanguansee discovered that PAM incorrectly cleared failed
 login attempt records when certain services invoked the account phase
 without first performing authentication. An attacker could possibly use
 this issue to reset failed login counters, resulting in authentication
 lockout restrictions being bypassed.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libpam-modules                  1.7.0-5ubuntu3.2
  libpam-modules-bin              1.7.0-5ubuntu3.2
  libpam-runtime                  1.7.0-5ubuntu3.2
  libpam0g                        1.7.0-5ubuntu3.2
  libpam0g-dev                    1.7.0-5ubuntu3.2

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8688-2
  https://ubuntu.com/security/notices/USN-8688-1
  https://launchpad.net/bugs/2164901

Package Information:
  https://launchpad.net/ubuntu/+source/pam/1.7.0-5ubuntu3.2


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqXB2QACgkQcpJm3tlz
hgGLuRAAubPuPyPGQhHXhFzrWsxL8P4T+Ybvjbh5ogwASyaEwZn2fxa22peOdMb/
4n34D36aXurPlZOo7MHpywRkV+AccnXgi/NCGaYcXsPcqpimKj3/GMn9GlwJeGZi
U68iKreEEvNbSoLfGjJ/Cz94uZhJ2dgqS8HtX6ZR3d7EF5p0WUEKtaOfJ7+e/Kk4
gzdDV6CswShAdA/drVaWj22sxgyoqh5P0rHp3SLnEiVyYzpGU8A+fQLSKADTMQIt
s2H++/X9MbaVzPCJO2WymFp5Y2oP2VzrpZAoFg8JyGoFKzYGNIVbS6x3nshHK6lD
fvyduO3FMrUFbLLNNC4LsJVTvrVuWQ9FLzVSoCTTPJU/rmIVlKmgOnpzafZaNGIL
wZpCVDxQ31tgsiKnjpRceD0C0KN5JF/XIZl7rH2OhgtZ3eZkrOWRmL/i89plPTqj
C3iZDzL3DGRr3dwaJbx67T1l7g5tw8FMFK936FxqR8zD4BF4iQYR2ZG94qxtUAxm
bbEu2jRirVrsayScPXR30EyQd8kV1THnr6iV3CMdvKjj0+9XbxRQ2fzQoyrTSZO0
NkbvHa6A52AHbOnEe/RA/x8KHaoLY+uUttwGT/LjBW7iSvO/CkGEZbIXD9/5Eaj4
ig7//8sjXCPs5urX11Ljaow38wAC47fLLLxRCdbEx41byrlRTtk=
=1wUP
-----END PGP SIGNATURE-----