Описание
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
Отчет
This vulnerability is classified as low severity despite of confidentiality is high because it requires an attacker to have elevated access privileges to exploit the issue, an attacker must already have significant access to the system to retrieve the password from memory. Additionally, the issue is limited to specific scenarios where a password attempt fails, which reduces its overall risk.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | shadow-utils | Out of support scope | ||
| Red Hat Enterprise Linux 7 | shadow-utils | Out of support scope | ||
| Red Hat Enterprise Linux 8 | shadow-utils | Fixed | RHSA-2023:7112 | 14.11.2023 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | shadow-utils | Fixed | RHSA-2024:0417 | 25.01.2024 |
| Red Hat Enterprise Linux 8.8 Extended Update Support | shadow-utils | Fixed | RHSA-2024:2577 | 30.04.2024 |
| Red Hat Enterprise Linux 9 | shadow-utils | Fixed | RHSA-2023:6632 | 07.11.2023 |
Показывать по
Дополнительная информация
Статус:
4.7 Medium
CVSS3
Связанные уязвимости
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
A flaw was found in shadow-utils. When asking for a new password, shad ...
4.7 Medium
CVSS3