Public bug reported:
A new release of pam is available for merging from Debian.
Ubuntu: 1.7.0-5ubuntu4
Debian Unstable: 1.7.0-8
### New Debian Changes ###
pam (1.7.0-8) unstable; urgency=high
* Fix debian/patches stack from 1.7.0-7, Closes: #1141076
- Somehow gbp pq export lost a patch between 1.7.0-6 and 1.7.0-7. I
have not been able to reproduce the issue; apparently my local
patch-queue branch was in an inconsistent state.
- So regenerate and reaudit patch-queue.
-- Sam Hartman <[email protected]> Wed, 08 Jul 2026 09:51:33 -0600
pam (1.7.0-7) unstable; urgency=medium
* Stop documenting /usr/lib/pam.d; for now, Closes: #1140029
- See that bug for discussion of next steps
- Also includes a disabled patch to log when config files are found in
/usr/lib/pam.d; that patch will be enablde or removed.
-- Sam Hartman <[email protected]> Fri, 03 Jul 2026 16:40:14 -0600
pam (1.7.0-6) unstable; urgency=medium
[ Gioele Barabucci ]
* d/libpam-modules.preinst: Remove outdated screensaver-related code
(Closes: #1073129)
* d/libpam-modules.templates: Remove unused debconf variables
* d/libpam-runtime.lintian-overrides: Document why prerm is empty
* d/watch: Avoid leading spaces in non-continuation lines
* d/s/lintian-overrides: Remove outdated
dh-quilt-addon-but-quilt-source-format
* d/libpam0g.lintian-overrides: Remove outdated override for false positive
package-name-doesnt-match-sonames
* d/libpam-{modules,runtime}.post{inst,rm}: Use `set -e` instead of `/bin/sh
-e`
* d/libpam-modules.lintian-overrides: Use new name
shared-library-lacks-prerequisites
* d/libpam0g.symbols: Add Build-Depends-Package
* d/lintian-overrides: Document that sysadmin manpages are libpam-runtime
* d/libpam-modules.lintian-overrides: Remove unused hardening overrides
* d/u/metadata: Add Repository URL
* Add support for <!nodoc>
* d/control: Remove outdated constraints
* d/libpam-modules.postinst: Drop redundant version check
* d/libpam-runtime.postinst: Drop redundant version check
[ Luca Boccassi ]
* libpam0g-dev: depend on libaudit-dev (Closes: #1120040)
[ Simon Chopin ]
* d/p/031_pam_include: fix loading from /usr/lib/pam.d (launchpad bug
2087827)
[ Sam Hartman ]
* I have merged in the fix to pam_include on /usr/lib/pam.d. However as
discussed, it was never my intent to support /usr/lib/pam.d on
Debian. This is merged as an emergency and potentially temporary work
around for #1140029. I am leaving that bug open to block this version
of pam from testing until I figure out what the long-term solution
is. It likely involves logging an error whenever /usr/lib/pam.d is
used.
-- Sam Hartman <[email protected]> Mon, 15 Jun 2026 21:03:10 -0600
### Old Ubuntu Delta ###
pam (1.7.0-5ubuntu4) stonking; urgency=medium
* SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb
module string comparisons
- debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison
timing leak in libpam/include/pam_inline.h,
modules/pam_userdb/pam_userdb.c.
- CVE-2026-54411
-- Marc Deslauriers <[email protected]> Thu, 16 Jul 2026
09:34:12 -0400
pam (1.7.0-5ubuntu3) resolute; urgency=medium
* No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)
-- Sebastien Bacher <[email protected]> Mon, 02 Feb 2026 21:33:17
+0100
pam (1.7.0-5ubuntu2) questing; urgency=medium
* Rebuild to include updated RISC-V base ISA RVA23
-- Heinrich Schuchardt <[email protected]> Sat, 06 Sep
2025 15:08:48 +0000
pam (1.7.0-5ubuntu1) questing; urgency=medium
* Merge with Debian unstable (LP: #2112053). Remaining changes:
- debian/libpam-modules.postinst: Add PATH to /etc/environment if it's
not present there or in /etc/security/pam_env.conf. (should send to
Debian).
- debian/libpam0g.postinst: only ask questions during update-manager
when there are non-default services running.
- debian/libpam0g.postinst: check if gdm is actually running before
trying to reload it.
- debian/patches/pam_motd-legal-notice: display the contents of
/etc/legal once, then set a flag in the user's homedir to prevent
showing it again.
- debian/patches/ubuntu-rlimit_nice_correction: Explicitly
initialise RLIMIT_NICE rather than relying on the kernel limits.
- debian/update-motd.5, debian/libpam-runtime.manpages: add a manpage
for update-motd, with some best practices and notes of explanation.
- debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)
to update-motd(5)
- debian/local/common-session{,-noninteractive}: Enable pam_umask by
default, now that the umask setting is gone from /etc/profile.
- debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.
- debian/patches/extrausers.patch: Add a pam_extrausers module
that is basically just a copy of pam_unix but looks at
/var/lib/extrausers/{group,passwd,shadow} instead of /etc/
- debian/libpam-modules-bin.install: install the helper binaries for
pam_extrausers to /sbin
- debian/rules: Make pam_extrausers_chkpwd sguid shadow
- Add lintian override for pam_extrausers_chkpwd
- Disable custom daemon restart detection code if needrestart is available
- d/p/pam_env-remove-deprecation-notice-for-user_readenv.patch: drop
deprecation warning about user_readenv from pam_env (LP 2059859)
- debian/patches/pam_umask_usergroups_from_login.defs.patch:
Deprecate pam_unix's explicit "usergroups" option and instead read it
from /etc/login.def's "USERGROUP_ENAB" option if umask is only defined
there. This restores compatibility with the pre-PAM behaviour of login.
- d/po/eu.po, d/po/fi.po, d/po/vi.po: Clean-up translation files
- debian/patches/fix-pam_motd_ftbfs.patch: fix FTBFS in display_legal()
- d/p/031_pam_include: fix loading from /usr/lib/pam.d (LP #2087827)
* Drop Changes:
- debian/pam-configs/mkhomedir: honor default private home directory
permissions for pam_mkdir.so by specifying a umask of 0027
(LP #1957024)
[Dropped the above change and its revert below]
- debian/pam-configs/mkhomedir: remove umask override added previously
for LP #1957024 as this is not actually needed since pam_mkhomedir
already respects HOME_MODE from login.defs and it complicates umask
management in general
- SECURITY UPDATE: privilege escalation via pam_namespace
[Fixed in 1.7.0-4]
* Changed Delta:
- d/p/extrausers.patch,
d/p/pam_umask_usergroups_from_login.defs.patch,
d/p/update-motd-manpage-ref: Update patches to work with meson. Drop
text-based man-pages in favor of XML ones. Add required code to build
scripts.
- debian/tests/usr-lib-config: Fix typo in "mv /usr/lib/pam.d/passwd
/etc/pam.d/*"
-- Ankush Pathak <[email protected]> Thu, 03 Jul 2025
22:03:16 +0530
** Affects: pam (Ubuntu)
Importance: Wishlist
Status: New
** Tags: dcr-merge
** Changed in: pam (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: pam (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171241
Title:
Merge pam 1.7.0-8 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pam/+bug/2171241/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
