A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade shadow-utilsUpgrade shadow-utils-subid-develUpgrade shadow-utils-subid | Nov 16, 2023 | Nov 7, 2023 |
| Amazon Linux Ami 2 | — | Upgrade shadow-utils-debuginfoUpgrade shadow-utils | Sep 21, 2023 | Sep 21, 2023 |
| Amazon_linux | — | Upgrade shadow-utils | May 13, 2025 | Nov 3, 2023 |
| Amazon_linux_2023 | — | Upgrade shadow-utils-subidUpgrade shadow-utilsUpgrade shadow-utils-subid-debuginfoUpgrade shadow-utils-debugsourceUpgrade shadow-utils-debuginfoUpgrade shadow-utils-subid-devel | Feb 17, 2025 | Jun 17, 2023 |
| Centos_linux | — | Upgrade shadow-utils-subidUpgrade shadow-utilsUpgrade shadow-utils-debugsourceUpgrade shadow-utils-debuginfoUpgrade shadow-utils-subid-debuginfo | Nov 8, 2023 | Nov 7, 2023 |
| Debian | — | Upgrade shadow | Apr 21, 2025 | Dec 27, 2023 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024225 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 29, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade shadow-utils | Mar 13, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Oracle_linux | — | Upgrade shadow-utilsUpgrade shadow-utils-subid-develUpgrade shadow-utils-subid | May 21, 2024 | Jun 17, 2023 |
| Redhat_linux | — | Upgrade shadow-utils-subidNo solution existsUpgrade shadow-utils-subid-debuginfoUpgrade shadow-utilsUpgrade shadow-utils-subid-develUpgrade shadow-utils-debuginfoUpgrade shadow-utils-debugsource | Nov 8, 2023 | Nov 7, 2023 |
| Suse | — | Upgrade login_defsUpgrade shadow | Sep 14, 2023 | Sep 13, 2023 |
| Ubuntu | — | Upgrade uidmap (Ubuntu Pro)Upgrade libsubid4Upgrade passwdUpgrade libsubid-devUpgrade login (Ubuntu Pro)Upgrade uidmapUpgrade passwd (Ubuntu Pro)Upgrade login | Feb 16, 2024 | Dec 27, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 27, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub