diff -pruN 10-8/debian/changelog 10-8ubuntu1/debian/changelog
--- 10-8/debian/changelog	2019-10-25 22:28:29.000000000 +0000
+++ 10-8ubuntu1/debian/changelog	2021-02-04 16:33:15.000000000 +0000
@@ -1,3 +1,11 @@
+libpam-ccreds (10-8ubuntu1) hirsute; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/patches/0003-initialize-libgcrypt.patch: Initialize gcrypt
+      before usage.  Closes: #645229, LP #869166.
+
+ -- Sebastien Bacher <seb128@debian.org>  Thu, 04 Feb 2021 17:33:15 +0100
+
 libpam-ccreds (10-8) unstable; urgency=medium
 
   [ Helmut Grohne ]
diff -pruN 10-8/debian/patches/0003-initialize-libgcrypt.patch 10-8ubuntu1/debian/patches/0003-initialize-libgcrypt.patch
--- 10-8/debian/patches/0003-initialize-libgcrypt.patch	1970-01-01 00:00:00.000000000 +0000
+++ 10-8ubuntu1/debian/patches/0003-initialize-libgcrypt.patch	2021-02-04 16:33:11.000000000 +0000
@@ -0,0 +1,33 @@
+Description: Initialize gcrypt before usage
+ Initialize libgcrypt before calling any of its functions.  The patch was
+ slightly modified by Andreas Hasenack to check if the library wasn't
+ initialized already using the advice in "2.4 Initializing the library" of the
+ gcrypt info page. Also see
+ https://lists.gnupg.org/pipermail/gcrypt-devel/2003-August/000458.html for
+ the same advice.
+Author: Juha Sahakangas <juhasa+launchpad@gmail.com>
+Author: Andreas Hasenack <andreas@canonical.com>
+Bug-Debian: https://bugs.debian.org/645229
+Bug-Ubuntu: https://launchpad.net/bugs/869166
+Forwarded: yes, emailed enquiry@padl.com
+Applied-Upstream: https://github.com/PADL/pam_ccreds/commit/3fa53ee374e4712643f988ef74bd6d52a6fe0c12
+Last-Update: 2017-07-28
+
+--- a/cc_lib.c
++++ b/cc_lib.c
+@@ -38,6 +38,15 @@
+ #ifdef HAVE_OPENSSL_OPENSSLCONF_H
+ 	SHA_CTX sha_ctx;
+ #else
++    if (!gcry_control (GCRYCTL_ANY_INITIALIZATION_P)) {
++        if (!gcry_check_version (NULL)) {
++            syslog (LOG_ERR, "pam_ccreds: failed to initialize libgcrypt");
++            return PAM_SERVICE_ERR;
++        }
++        gcry_control (GCRYCTL_DISABLE_SECMEM, 0);
++        gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
++    }
++
+ 	gcry_md_hd_t handle;
+ #endif
+ 	unsigned char T[4];
diff -pruN 10-8/debian/patches/series 10-8ubuntu1/debian/patches/series
--- 10-8/debian/patches/series	2018-11-02 11:51:54.000000000 +0000
+++ 10-8ubuntu1/debian/patches/series	2021-02-04 16:33:15.000000000 +0000
@@ -1,2 +1,3 @@
 PATCH-make-sure-we-don-t-overflow-the-data-buffer.patch
 PATCH-add-minimum_uid-option.patch
+0003-initialize-libgcrypt.patch