Security Vulnerability in shadow-utils: Default Subordinate ID Configuration Risk
Summary
ALSA-2025:20559: Low: shadow-utils security update. Affects shadow-utils versions < 2:4.9-15.el9. Fixed in 2:4.9-15.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The shadow-utils package is an essential component in UNIX-like operating systems, providing utilities for managing user and group accounts and converting UNIX password files to the shadow password format. It plays a crucial role in enhancing system security by controlling user access and password management. However, a recent vulnerability has been identified that could compromise the security of systems using this package, particularly in the context of subordinate user IDs.
Vulnerability Detail
The vulnerability arises from a default configuration in the /etc/login.defs file, which can lead to unauthorized access and potential compromise of user accounts. Specifically, the issue is linked to the handling of subordinate IDs, which, if misconfigured, may allow attackers to exploit this weakness and gain elevated privileges or access sensitive information. This vulnerability has been assigned the identifier CVE-2024-56433, highlighting its significance and the need for immediate attention.
How To Fix
Minimum fixed version
2:4.9-15.el9
This is the first release that contains the fix.
sudo dnf update shadow-utilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can manually review and adjust the subordinate ID configurations in the /etc/login.defs file to mitigate the risk until the package is updated. It is advisable to restrict subordinate IDs to trusted users only.
Conclusion
The shadow-utils package has a critical vulnerability related to its default subordinate ID configuration, which could lead to unauthorized access if not addressed. Updating to the patched version is essential for maintaining system security. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for shadow-utils →
FAQ
CVE-2024-56433 is the identifier for a security vulnerability in the shadow-utils package that can lead to unauthorized access due to misconfigured subordinate IDs.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Subordinate IDs are user identifiers that allow for the management of user permissions and access levels in a UNIX-like operating system, particularly for non-root users.
If an immediate update is not possible, review and adjust the subordinate ID configurations in /etc/login.defs to limit access until the update can be applied.
Detailed information about the shadow-utils package and its functionalities can be found in the AlmaLinux Release Notes and the official documentation.
Related vulnerabilities
Recent vulnerabilities recorded for shadow-utils.
