CVE-2023-4641
published 2023-12-27CVE-2023-4641: A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt…
medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | shadow | < shadow 1:4.13+dfsg1-1+deb12u1 (bookworm) | shadow 1:4.13+dfsg1-1+deb12u1 (bookworm) |
| msrc | cbl2_shadow-utils_4.9-14_on_cbl_mariner_2.0 | — | — |
| redhat | codeready_linux_builder | — | — |
| redhat | codeready_linux_builder | — | — |
| redhat | codeready_linux_builder_for_arm64 | — | — |
| redhat | codeready_linux_builder_for_arm64 | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems | — | — |
| redhat | codeready_linux_builder_for_power_little_endian | — | — |
| redhat | codeready_linux_builder_for_power_little_endian | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_for_arm_64 | — | — |
| redhat | enterprise_linux_for_arm_64 | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| shadow-maint | shadow-utils | < 4.14.0 | 4.14.0 |
| shadow_project | shadow | >= 0 < 1:4.8.1-1+deb11u1 | 1:4.8.1-1+deb11u1 |
| shadow_project | shadow | >= 0 < 1:4.13+dfsg1-1+deb12u1 | 1:4.13+dfsg1-1+deb12u1 |
| shadow_project | shadow | >= 0 < 1:4.13+dfsg1-2 | 1:4.13+dfsg1-2 |
| shadow_project | shadow | >= 0 < 1:4.13+dfsg1-2 | 1:4.13+dfsg1-2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv5.5MEDIUM