CVE-2023-29383
published 2023-04-14CVE-2023-29383: In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to…
PriorityP411low3.3CVSS 3.1
AVLACLPRLUINSUCNILAN
EPSS
0.43%
34.7th percentile
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | shadow | < shadow 1:4.13+dfsg1-1+deb12u1 (bookworm) | shadow 1:4.13+dfsg1-1+deb12u1 (bookworm) |
| msrc | cbl2_shadow-utils_4.9-13_on_cbl_mariner_2.0 | — | — |
| shadow_project | shadow | — | — |
| shadow_project | shadow | >= 0 < 1:4.8.1-1+deb11u1 | 1:4.8.1-1+deb11u1 |
| shadow_project | shadow | >= 0 < 1:4.13+dfsg1-1+deb12u1 | 1:4.13+dfsg1-1+deb12u1 |
| shadow_project | shadow | >= 0 < 1:4.13+dfsg1-2 | 1:4.13+dfsg1-2 |
| shadow_project | shadow | >= 0 < 1:4.13+dfsg1-2 | 1:4.13+dfsg1-2 |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
osv3.3LOW
vendor_debian3.3LOW
vendor_msrc3.3LOW
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p9w4-8hh8-crcx: In Shadow 4
ghsa_unreviewed·2023-04-15
CVE-2023-29383 [LOW] CWE-125 GHSA-p9w4-8hh8-crcx: In Shadow 4
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
OSV
CVE-2023-29383: In Shadow 4
osv·2023-04-14·CVSS 3.3
CVE-2023-29383 [LOW] CVE-2023-29383: In Shadow 4
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
Red Hat
shadow: Improper input validation in shadow-utils package utility chfn
vendor_redhat·2023-04-15·CVSS 3.3
CVE-2023-29383 [LOW] CWE-20 shadow: Improper input validation in shadow-utils package utility chfn
shadow: Improper input validation in shadow-utils package utility chfn
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
A flaw was found in Shadow, where it
Microsoft
In Shadow 4.13 it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g. adding a new user f
vendor_msrc·2023-04-11·CVSS 3.3
CVE-2023-29383 [LOW] CWE-74 In Shadow 4.13 it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g. adding a new user f
In Shadow 4.13 it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g. adding a new user fails because \n is in the block list) it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words an adversary may be able to convince a system administrator to take the system offline (an indirect social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially
Debian
CVE-2023-29383: shadow - In Shadow 4.13, it is possible to inject control characters into fields provided...
vendor_debian·2023·CVSS 3.3
CVE-2023-29383 [LOW] CVE-2023-29383: shadow - In Shadow 4.13, it is possible to inject control characters into fields provided...
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
Scope: local
bookworm: resolved (fixed in 1:4.13+dfsg1-1+deb12u1)
bullseye: resolved (fixed in 1:4.8.1-1+deb11
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-29383 shadow: Improper input validation in shadow-utils package utility chfn
bugzilla·2023-04-17·CVSS 3.3
CVE-2023-29383 [LOW] CVE-2023-29383 shadow: Improper input validation in shadow-utils package utility chfn
CVE-2023-29383 shadow: Improper input validation in shadow-utils package utility chfn
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
https://github.com/sha
arXiv
SBOMproof: Beyond Alleged SBOM Compliance for Supply Chain Security of Container Images
arxiv_fulltext·2025-10-07
SBOMproof: Beyond Alleged SBOM Compliance for Supply Chain Security of Container Images
SBOMproof: Beyond Alleged SBOM Compliance for Supply Chain Security of Container Images
Jacopo Bufalino
Cnam, Cedric, Paris, France
Aalto University, Espoo, Finland
[email protected]
Mario Di Francesco
Aalto University, Espoo, Finland
[email protected]
Agathe Blaise
Thales SIX GTS France,
Gennevilliers, France
[email protected]
Stefano Secci
Cnam, Cedric, Paris, France
[email protected]
observationcounter
observationcounter1
8.7510
observation
colback=gray!10,
colframe=gray!70,
boxrule=0.5mm,
arc=1mm,
left=2mm,
right=2mm,
top=1mm,
bottom=1mm,
before upper=observationcounter,
title=Observation ,
fontupper= ,
fonttitle= ,
code=1.025
## Abstract
Supply chain security is extremely important for modern applications running at scale in the cloud.
https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663dhttps://github.com/shadow-maint/shadow/pull/687https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663dhttps://github.com/shadow-maint/shadow/pull/687https://lists.debian.org/debian-lts-announce/2025/04/msg00026.htmlhttps://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797
2023-04-14
Published