{"id":"UBUNTU-CVE-2026-3184","details":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.","modified":"2026-08-31T22:15:16.831585197Z","published":"2026-04-03T19:17:00Z","related":["USN-8702-1"],"upstream":["CVE-2026-3184"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-3184"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-3184"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8702-1"}],"affected":[{"package":{"name":"util-linux","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/util-linux?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.40.2-14ubuntu1","2.41-4ubuntu2","2.41-4ubuntu3","2.41-4ubuntu4","2.41-4ubuntu4.1","2.41-4ubuntu4.2"],"ecosystem_specific":{"binaries":[{"binary_version":"2.41-4ubuntu4.2","binary_name":"bsdextrautils"},{"binary_version":"1:2.41-4ubuntu4.2","binary_name":"bsdutils"},{"binary_version":"2.41-4ubuntu4.2","binary_name":"eject"},{"binary_name":"fdisk","binary_version":"2.41-4ubuntu4.2"},{"binary_version":"2.41-4ubuntu4.2","binary_name":"lastlog2"},{"binary_name":"libblkid1","binary_version":"2.41-4ubuntu4.2"},{"binary_name":"libfdisk1","binary_version":"2.41-4ubuntu4.2"},{"binary_name":"liblastlog2-2","binary_version":"2.41-4ubuntu4.2"},{"binary_name":"libmount1","binary_version":"2.41-4ubuntu4.2"},{"binary_name":"libpam-lastlog2","binary_version":"2.41-4ubuntu4.2"},{"binary_version":"2.41-4ubuntu4.2","binary_name":"libsmartcols1"},{"binary_name":"libuuid1","binary_version":"2.41-4ubuntu4.2"},{"binary_name":"login","binary_version":"1:4.16.0-2+really2.41-4ubuntu4.2"},{"binary_name":"mount","binary_version":"2.41-4ubuntu4.2"},{"binary_name":"rfkill","binary_version":"2.41-4ubuntu4.2"},{"binary_name":"util-linux","binary_version":"2.41-4ubuntu4.2"},{"binary_name":"util-linux-extra","binary_version":"2.41-4ubuntu4.2"},{"binary_name":"util-linux-locales","binary_version":"2.41-4ubuntu4.2"},{"binary_name":"uuid-runtime","binary_version":"2.41-4ubuntu4.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-3184.json"}},{"package":{"name":"util-linux","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/util-linux?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.3-3ubuntu2.2"}]}],"versions":["2.41-4ubuntu4","2.41.2-4ubuntu1","2.41.2-4ubuntu2","2.41.2-4ubuntu3","2.41.3-3ubuntu1","2.41.3-3ubuntu2"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"bsdextrautils","binary_version":"2.41.3-3ubuntu2.2"},{"binary_name":"bsdutils","binary_version":"1:2.41.3-3ubuntu2.2"},{"binary_name":"eject","binary_version":"2.41.3-3ubuntu2.2"},{"binary_version":"2.41.3-3ubuntu2.2","binary_name":"fdisk"},{"binary_version":"2.41.3-3ubuntu2.2","binary_name":"lastlog2"},{"binary_name":"libblkid1","binary_version":"2.41.3-3ubuntu2.2"},{"binary_name":"libfdisk1","binary_version":"2.41.3-3ubuntu2.2"},{"binary_name":"liblastlog2-2","binary_version":"2.41.3-3ubuntu2.2"},{"binary_version":"2.41.3-3ubuntu2.2","binary_name":"libmount1"},{"binary_name":"libpam-lastlog2","binary_version":"2.41.3-3ubuntu2.2"},{"binary_version":"2.41.3-3ubuntu2.2","binary_name":"libsmartcols1"},{"binary_name":"libuuid1","binary_version":"2.41.3-3ubuntu2.2"},{"binary_version":"1:4.16.0-2+really2.41.3-3ubuntu2.2","binary_name":"login"},{"binary_name":"mount","binary_version":"2.41.3-3ubuntu2.2"},{"binary_name":"rfkill","binary_version":"2.41.3-3ubuntu2.2"},{"binary_name":"util-linux","binary_version":"2.41.3-3ubuntu2.2"},{"binary_name":"util-linux-extra","binary_version":"2.41.3-3ubuntu2.2"},{"binary_version":"2.41.3-3ubuntu2.2","binary_name":"util-linux-locales"},{"binary_name":"uuid-runtime","binary_version":"2.41.3-3ubuntu2.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-3184.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}