A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade shadow-utils-subid-develUpgrade shadow-utils-subidUpgrade shadow-utils | Nov 16, 2023 | Nov 7, 2023 |
| Amazon Linux Ami 2 | — | Upgrade shadow-utils-debuginfoUpgrade shadow-utils | Sep 21, 2023 | Sep 21, 2023 |
| Amazon_linux | — | Upgrade shadow-utils | May 13, 2025 | Nov 3, 2023 |
| Amazon_linux_2023 | — | Upgrade shadow-utils-subid-debuginfoUpgrade shadow-utils-debugsourceUpgrade shadow-utils-subid-develUpgrade shadow-utils-debuginfoUpgrade shadow-utils-subidUpgrade shadow-utils | Feb 17, 2025 | Jun 17, 2023 |
| Centos_linux | — | Upgrade shadow-utils-subidUpgrade shadow-utils-debugsourceUpgrade shadow-utils-debuginfoUpgrade shadow-utilsUpgrade shadow-utils-subid-debuginfo | Nov 8, 2023 | Nov 7, 2023 |
| Debian | — | Upgrade shadow | Apr 21, 2025 | Dec 27, 2023 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024225 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 29, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade shadow-utils | Mar 13, 2024 | Dec 27, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade shadow | Jan 10, 2024 | Dec 27, 2023 |
| Oracle_linux | — | Upgrade shadow-utils-subid-develUpgrade shadow-utilsUpgrade shadow-utils-subid | May 21, 2024 | Jun 17, 2023 |
| Redhat_linux | — | No solution existsUpgrade shadow-utils-subidUpgrade shadow-utils-subid-debuginfoUpgrade shadow-utils-debuginfoUpgrade shadow-utils-subid-develUpgrade shadow-utilsUpgrade shadow-utils-debugsource | Nov 8, 2023 | Nov 7, 2023 |
| Suse | — | Upgrade shadowUpgrade login_defs | Sep 14, 2023 | Sep 13, 2023 |
| Ubuntu | — | Upgrade passwd (Ubuntu Pro)Upgrade loginUpgrade passwdUpgrade login (Ubuntu Pro)Upgrade uidmapUpgrade uidmap (Ubuntu Pro)Upgrade libsubid-devUpgrade libsubid4 | Feb 16, 2024 | Dec 27, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 27, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub