Low: shadow-utils security and bug fix update
Summary
ALSA-2023:6632: Low: shadow-utils security and bug fix update. Affects shadow-utils versions < 2:4.9-8.el9. Fixed in 2:4.9-8.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The shadow-utils package is a collection of programs used for converting UNIX password files to the shadow password format and managing user and group accounts. It provides utilities for password management and user/group administration. This vulnerability affects the shadow-utils package in AlmaLinux 9.
Vulnerability Detail
The vulnerability (CVE-2023-4641) in shadow-utils allows for a possible password leak during the password change process using the passwd(1) command. This could lead to unauthorized access to user passwords. The impact of this vulnerability is low, but it is still important to address it to ensure the security of user accounts.
How To Fix
Minimum fixed version
2:4.9-8.el9
This is the first release that contains the fix.
sudo dnf update shadow-utilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by updating the shadow-utils package.
Conclusion
The shadow-utils package in AlmaLinux 9 is affected by a low-severity vulnerability that could potentially lead to a password leak. It is recommended to update the package to version 2:4.9-8.el9 or later to fix this vulnerability and ensure the security of user accounts. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for shadow-utils →
FAQ
The impact of this vulnerability is low, but it could potentially lead to unauthorized access to user passwords.
You can check the version of the shadow-utils package installed on your AlmaLinux system. If it is earlier than version 2:4.9-8.el9, your system may be affected.
There is no known exploit for this vulnerability at the moment.
There are no other related vulnerabilities mentioned in the provided information.
You can refer to the CVE page(s) listed in the References section of the provided information for more details about this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for shadow-utils.
