A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:6632 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:7112 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2024:0417 | |
| https://access.redhat.com/errata/RHSA-2024:2577 | |
| https://access.redhat.com/security/cve/CVE-2023-4641 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2215945 | Issue Tracking |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
03 May 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Jan 2024, 17:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/errata/RHSA-2023:6632 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:7112 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2023-4641 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2215945 - Issue Tracking | |
| CPE | cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:8.0_aarch64:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:a:shadow-maint:shadow-utils:*:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* |
|
| CWE | CWE-287 | |
| First Time |
Redhat codeready Linux Builder For Arm64
Redhat codeready Linux Builder For Power Little Endian Redhat enterprise Linux For Arm 64 Redhat enterprise Linux Redhat enterprise Linux For Ibm Z Systems Redhat codeready Linux Builder Redhat enterprise Linux For Power Little Endian Redhat Shadow-maint shadow-utils Redhat codeready Linux Builder For Ibm Z Systems Shadow-maint |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
27 Dec 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-27 16:15
Updated : 2024-05-03 16:15
NVD link : CVE-2023-4641
Mitre link : CVE-2023-4641
CVE.ORG link : CVE-2023-4641
JSON object : View
Products Affected
redhat
- codeready_linux_builder_for_arm64
- enterprise_linux
- enterprise_linux_for_arm_64
- codeready_linux_builder
- enterprise_linux_for_ibm_z_systems
- codeready_linux_builder_for_power_little_endian
- codeready_linux_builder_for_ibm_z_systems
- enterprise_linux_for_power_little_endian
shadow-maint
- shadow-utils