A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade shadow-utils-subid-develUpgrade shadow-utils-subidUpgrade shadow-utils | Nov 16, 2023 | Nov 7, 2023 |
| Amazon Linux Ami 2 | — | Upgrade shadow-utilsUpgrade shadow-utils-debuginfo | Sep 21, 2023 | Sep 21, 2023 |
| Amazon_linux | — | Upgrade shadow-utils | May 13, 2025 | Nov 3, 2023 |
| Amazon_linux_2023 | — | Upgrade shadow-utilsUpgrade shadow-utils-subidUpgrade shadow-utils-subid-debuginfoUpgrade shadow-utils-subid-develUpgrade shadow-utils-debuginfoUpgrade shadow-utils-debugsource | Feb 17, 2025 | Jun 17, 2023 |
| Centos_linux | — | Upgrade shadow-utils-subid-debuginfoUpgrade shadow-utils-debuginfoUpgrade shadow-utilsUpgrade shadow-utils-debugsourceUpgrade shadow-utils-subid | Nov 8, 2023 | Nov 7, 2023 |
| Debian | — | Upgrade shadow | Apr 21, 2025 | Dec 27, 2023 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024225 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 29, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade shadow-utils | Mar 13, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Oracle_linux | — | Upgrade shadow-utils-subid-develUpgrade shadow-utilsUpgrade shadow-utils-subid | May 21, 2024 | Jun 17, 2023 |
| Redhat_linux | — | Upgrade shadow-utils-subid-debuginfoUpgrade shadow-utils-debuginfoUpgrade shadow-utilsUpgrade shadow-utils-debugsourceUpgrade shadow-utils-subid-develNo solution existsUpgrade shadow-utils-subid | Nov 8, 2023 | Nov 7, 2023 |
| Suse | — | Upgrade login_defsUpgrade shadow | Sep 14, 2023 | Sep 13, 2023 |
| Ubuntu | — | Upgrade loginUpgrade passwd (Ubuntu Pro)Upgrade libsubid-devUpgrade passwdUpgrade uidmap (Ubuntu Pro)Upgrade login (Ubuntu Pro)Upgrade libsubid4Upgrade uidmap | Feb 16, 2024 | Dec 27, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 27, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub