This bug was fixed in the package pam - 1.4.0-11ubuntu2.8
---------------
pam (1.4.0-11ubuntu2.8) jammy-security; urgency=medium
* SECURITY UPDATE: account lockout bypass in pam_faillock account
management phase (LP: #2164901)
- debian/patches/lp-2164901.patch: skip clearing user's failed
attempt in modules/pam_faillock/pam_faillock.8.xml,
modules/pam_faillock/pam_faillock.c.
- No CVE number
-- Shafayat Hossain Majumder <[email protected]> Wed, 26
Aug 2026 15:28:32 -0400
** Changed in: pam (Ubuntu)
Status: In Progress => Fix Released
** Changed in: pam (Ubuntu)
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164901
Title:
pam_faillock lockout silently defeated by cron/systemd-user account-
phase calls - Ubuntu pam 1.7.0-5ubuntu3.1 predates upstream fix
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pam/+bug/2164901/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
