A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade shadow-utils-subidUpgrade shadow-utils-subid-develUpgrade shadow-utils | Nov 16, 2023 | Nov 7, 2023 |
| Amazon Linux Ami 2 | — | Upgrade shadow-utilsUpgrade shadow-utils-debuginfo | Sep 21, 2023 | Sep 21, 2023 |
| Amazon_linux | — | Upgrade shadow-utils | May 13, 2025 | Nov 3, 2023 |
| Amazon_linux_2023 | — | Upgrade shadow-utils-subid-develUpgrade shadow-utils-debugsourceUpgrade shadow-utils-debuginfoUpgrade shadow-utils-subid-debuginfoUpgrade shadow-utils-subidUpgrade shadow-utils | Feb 17, 2025 | Jun 17, 2023 |
| Centos_linux | — | Upgrade shadow-utils-subidUpgrade shadow-utils-debugsourceUpgrade shadow-utils-debuginfoUpgrade shadow-utilsUpgrade shadow-utils-subid-debuginfo | Nov 8, 2023 | Nov 7, 2023 |
| Debian | — | Upgrade shadow | Apr 21, 2025 | Dec 27, 2023 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024225 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 29, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade shadow-utils | Mar 13, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Oracle_linux | — | Upgrade shadow-utils-subidUpgrade shadow-utilsUpgrade shadow-utils-subid-devel | May 21, 2024 | Jun 17, 2023 |
| Redhat_linux | — | Upgrade shadow-utils-debugsourceUpgrade shadow-utils-subid-debuginfoUpgrade shadow-utils-debuginfoUpgrade shadow-utils-subid-develUpgrade shadow-utilsNo solution existsUpgrade shadow-utils-subid | Nov 8, 2023 | Nov 7, 2023 |
| Suse | — | Upgrade shadowUpgrade login_defs | Sep 14, 2023 | Sep 13, 2023 |
| Ubuntu | — | Upgrade libsubid4Upgrade passwdUpgrade uidmapUpgrade libsubid-devUpgrade uidmap (Ubuntu Pro)Upgrade login (Ubuntu Pro)Upgrade loginUpgrade passwd (Ubuntu Pro) | Feb 16, 2024 | Dec 27, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 27, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub