RHSA-2026:61224: Moderate: pam security update
Moderate: pam security update
Other sources
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.Security Fix(es): linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module (CVE-2026-54411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pamto a version that resolves this vulnerability.Fixed in 1.3.1-14.el8_4.3 - Upgrade
Upgrade
redhat/pam-debuginfoto a version that resolves this vulnerability.Fixed in 1.3.1-14.el8_4.3 - Upgrade
Upgrade
redhat/pam-debugsourceto a version that resolves this vulnerability.Fixed in 1.3.1-14.el8_4.3 - Upgrade
Upgrade
redhat/pam-develto a version that resolves this vulnerability.Fixed in 1.3.1-14.el8_4.3
Event History
Frequently Asked Questions
Which package variants are included in this advisory?
The advisory lists pam, pam-debuginfo, pam-debugsource, and pam-devel.
Which Red Hat Enterprise Linux offerings are listed as affected?
The advisory lists Red Hat Enterprise Linux for x86_64 Extended Life Cycle Long Life and Red Hat Enterprise Linux Server AUS.