pam (1.4.0-11ubuntu2.8) jammy-security; urgency=medium

  * SECURITY UPDATE: account lockout bypass in pam_faillock account
    management phase (LP: #2164901)
    - debian/patches/lp-2164901.patch: skip clearing user's failed
      attempt in modules/pam_faillock/pam_faillock.8.xml,
      modules/pam_faillock/pam_faillock.c.
    - No CVE number

 -- Shafayat Hossain Majumder <shafayat.majumder@canonical.com>  Wed, 26 Aug 2026 15:28:32 -0400

pam (1.4.0-11ubuntu2.7) jammy-security; urgency=medium

  * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb
    module string comparisons
    - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare
      strings in constant time in libpam/include/pam_inline.h.
    - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison
      timing leak in libpam/include/pam_inline.h,
      modules/pam_userdb/pam_userdb.c.
    - CVE-2026-54411

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 16 Jul 2026 10:06:00 -0400

pam (1.4.0-11ubuntu2.6) jammy-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via pam_namespace
    - debian/patches-applied/pam_namespace_170.patch: sync pam_namespace
      module to version 1.7.0.
    - debian/patches-applied/pam_namespace_post170-*.patch: add post-1.7.0
      changes from upstream git tree.
    - debian/patches-applied/pam_namespace_revert_abi.patch: revert ABI
      change to prevent unintended issues in running daemons.
    - debian/patches-applied/CVE-2025-6020-1.patch: fix potential privilege
      escalation.
    - debian/patches-applied/CVE-2025-6020-2.patch: add flags to indicate
      path safety.
    - debian/patches-applied/CVE-2025-6020-3.patch: secure_opendir: do not
      look at the group ownership.
    - debian/patches-applied/CVE-2024-22365.patch: removed, included in
      patch cluster above.
    - CVE-2025-6020

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 12 Jun 2025 10:45:28 -0400

pam (1.4.0-11ubuntu2.5) jammy; urgency=medium

  * Honor private home directory permissions (LP: #1957024)

 -- Ponnuvel Palaniyappan <pponnuvel@gmail.com>  Sun, 17 Nov 2024 10:17:22 +0000

pam (1.4.0-11ubuntu2.4) jammy-security; urgency=medium

  * SECURITY UPDATE: pam_namespace local denial of service
    - debian/patches-applied/CVE-2024-22365.patch: use O_DIRECTORY to
      prevent local DoS situations in modules/pam_namespace/pam_namespace.c.
    - CVE-2024-22365

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 10 Jan 2024 08:54:07 -0500

pam (1.4.0-11ubuntu2.3) jammy-security; urgency=medium

  * SECURITY REGRESSION: fix CVE-2022-28321 patch location
    - debian/patches-applied/CVE-2022-28321.patch: pam_access: handle
      hostnames in access.conf
    - CVE-2022-28321

 -- Nishit Majithia <nishit.majithia@canonical.com>  Thu, 02 Feb 2023 14:51:46 +0530

pam (1.4.0-11ubuntu2.1) jammy-security; urgency=medium

  * SECURITY UPDATE: authentication bypass vulnerability
    - debian/patches/CVE-2022-28321.patch: pam_access: handle hostnames in
      access.conf
    - CVE-2022-28321

 -- Nishit Majithia <nishit.majithia@canonical.com>  Tue, 24 Jan 2023 17:07:01 +0530

pam (1.4.0-11ubuntu2) jammy; urgency=medium

  * Drop Recommends on update-motd which is no longer used and is not being
    maintained.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 23 Mar 2022 18:43:24 -0700

pam (1.4.0-11ubuntu1) jammy; urgency=medium

  * Merge from Debian unstable, remaining changes:
    - debian/control: have libpam-modules recommend update-motd package
    - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's
      not present there or in /etc/security/pam_env.conf. (should send to
      Debian).
    - debian/libpam0g.postinst: only ask questions during update-manager when
      there are non-default services running.
    - debian/libpam0g.postinst: check if gdm is actually running before
      trying to reload it.
    - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly
      initialise RLIMIT_NICE rather than relying on the kernel limits.
    - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:
      Deprecate pam_unix's explicit "usergroups" option and instead read it
      from /etc/login.def's "USERGROUP_ENAB" option if umask is only defined
      there. This restores compatibility with the pre-PAM behaviour of login.
    - debian/patches-applied/pam_motd-legal-notice: display the contents of
      /etc/legal once, then set a flag in the user's homedir to prevent
      showing it again.
    - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage
      for update-motd, with some best practices and notes of explanation.
    - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)
      to update-motd(5)
    - debian/local/common-session{,-noninteractive}: Enable pam_umask by
      default, now that the umask setting is gone from /etc/profile.
    - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.
    - debian/patches-applied/extrausers.patch: Add a pam_extrausers module
      that is basically just a copy of pam_unix but looks at
      /var/lib/extrausers/{group,passwd,shadow} instead of /etc/
    - debian/libpam-modules-bin.install: install the helper binaries for
      pam_extrausers to /sbin
    - debian/rules: Make pam_extrausers_chkpwd sguid shadow
    - Add lintian override for pam_extrausers_chkpwd
    - Disable custom daemon restart detection code if needrestart is available
    - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment
  * Dropped changes, included in Debian:
    - d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:
      Allow /etc/environment files without EOL at EOF.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 07 Feb 2022 08:51:50 -0800

pam (1.4.0-11) unstable; urgency=medium

  * Whitespace fixes in debconf templates.

  [ Sergio Durigan Junior ]
  * d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:
    Allow /etc/environment files without EOL at EOF.  In other words,
    allow files without a newline at the end. (LP: #1953201)

 -- Steve Langasek <vorlon@debian.org>  Mon, 06 Dec 2021 11:11:31 -0800

# For older changelog entries, run 'apt-get changelog libpam-doc'
