CVE-2022-28321

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.

• CWE-287
• CWE-287

• http://download.opensuse.org/source/distribution/openSUSE-current/repo/oss/src/Patch, Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1197654Issue Tracking, Patch, Vendor Advisory
• https://www.suse.com/security/cve/CVE-2022-28321.htmlVendor Advisory
• http://download.opensuse.org/source/distribution/openSUSE-current/repo/oss/src/Patch, Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1197654Issue Tracking, Patch, Vendor Advisory
• https://www.suse.com/security/cve/CVE-2022-28321.htmlVendor Advisory

Published

Sep 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28316This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-28317This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-28318This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-28319This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-2832A flaw was found in Blender 3.3.0. A null pointer dereferenc…7.5
• CVE-2022-28320This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-28323An issue was discovered in MediaWiki through 1.37.2. The Sec…7.5
• CVE-2022-28327The generic P-256 feature in crypto/elliptic in Go before 1.…7.5
• CVE-2022-28328A vulnerability has been identified in SCALANCE W1788-1 M12 …7.5
• CVE-2022-28329A vulnerability has been identified in SCALANCE W1788-1 M12 …6.5
• CVE-2022-2833Endless Infinite loop in Blender-thumnailing due to logical …7.5
• CVE-2022-28330Apache HTTP Server 2.4.53 and earlier on Windows may read be…5.3