PT-2023-8971 · Unknown+9 · Shadow-Utils+9

Ybuenos · Published 2023-06-17 · Updated 2026-04-09 · CVE-2023-4641

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions shadow-utils (affected versions not specified)

Description A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-303

CWE-287

Related Identifiers

ALSA-2023:6632

ALSA-2023:7112

AZL-32253

BDU:2024-02776

CESA-2023_7112

CVE-2023-4641

DLA-4130-1

ECHO-C16B-48D0-7DA6

MGASA-2023-0294

OESA-2023-1687

OPENSUSE-SU-2023_4024-1

OPENSUSE-SU-2026:10081-1

RHSA-2023:6632

RHSA-2023:7112

RHSA-2023_6632

RHSA-2023_7112

RHSA-2024:0417

RHSA-2024:2577

ROSA-SA-2025-2609

SUSE-RU-2026:1228-1

SUSE-SU-2023:3591-1

SUSE-SU-2023:4023-1

SUSE-SU-2023:4024-1

SUSE-SU-2023:4025-1

SUSE-SU-2023:4027-1

SUSE-SU-2023_4023-1

SUSE-SU-2023_4024-1

SUSE-SU-2023_4025-1

SUSE-SU-2023_4027-1

SUSE-SU-2024:1007-1

SUSE-SU-2024:1007-2

USN-6640-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Red Hat

Red Os

Suse

Ubuntu

Shadow-Utils

References · 83

• https://osv.dev/vulnerability/SUSE-SU-2023:3591-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7112 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-4641 · Security Note
• https://advisories.mageia.org/MGASA-2023-0294.html · Security Note
• https://linux.oracle.com/errata/ELSA-2023-7112.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6640-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4641 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2023-4641 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4641 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-6632.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-6640-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-32253 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4130-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1007-2 · Vendor Advisory