PT-2023-8971 · Unknown+9 · Shadow-Utils+9

Ybuenos · Publicado 2023-06-17 · Atualizado 2026-04-09 · CVE-2023-4641

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions shadow-utils (affected versions not specified)

Description A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-303

CWE-287

Identificadores relacionados

ALSA-2023:6632

ALSA-2023:7112

AZL-32253

BDU:2024-02776

CESA-2023_7112

CVE-2023-4641

DLA-4130-1

ECHO-C16B-48D0-7DA6

MGASA-2023-0294

OESA-2023-1687

OPENSUSE-SU-2023_4024-1

OPENSUSE-SU-2026:10081-1

RHSA-2023:6632

RHSA-2023:7112

RHSA-2023_6632

RHSA-2023_7112

RHSA-2024:0417

RHSA-2024:2577

ROSA-SA-2025-2609

SUSE-RU-2026:1228-1

SUSE-SU-2023:3591-1

SUSE-SU-2023:4023-1

SUSE-SU-2023:4024-1

SUSE-SU-2023:4025-1

SUSE-SU-2023:4027-1

SUSE-SU-2023_4023-1

SUSE-SU-2023_4024-1

SUSE-SU-2023_4025-1

SUSE-SU-2023_4027-1

SUSE-SU-2024:1007-1

SUSE-SU-2024:1007-2

USN-6640-1

Produtos afetados

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Red Hat

Red Os

Suse

Ubuntu

Shadow-Utils

Referências · 83

• https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904 · Nota
• https://bugzilla.suse.com/1214806 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2023:3591-1 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:7112 · Aviso do Fabricante
• https://bugzilla.suse.com/1182850 · Nota
• https://bugzilla.suse.com/1187536 · Nota
• https://cve.org/CVERecord?id=CVE-2023-4641 · Nota de Segurança
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.13 · Nota
• https://advisories.mageia.org/MGASA-2023-0294.html · Nota de Segurança
• https://bugzilla.suse.com/1210507 · Nota
• https://suse.com/support/update/announcement/2024/suse-su-20241007-1 · Nota
• https://linux.oracle.com/errata/ELSA-2023-7112.html · Aviso do Fabricante
• https://bugzilla.suse.com/1181400 · Nota
• https://twitter.com/VulmonFeeds/status/1704647085591814639 · Publicação no Twitter
• https://ubuntu.com/security/notices/USN-6640-1 · Aviso do Fabricante