Security Vulnerability in shadow-utils: Default Subordinate ID Configuration Risk
Summary
RLSA-2025:20559: Low: shadow-utils security update. Affects shadow-utils versions < 2:4.9-15.el9. Fixed in 2:4.9-15.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The shadow-utils package is a critical component in UNIX-like operating systems, providing essential utilities for managing user and group accounts, as well as converting traditional UNIX password files to the shadow password format. This package plays a vital role in enhancing system security by ensuring that sensitive password information is stored securely. However, a recent vulnerability has been identified that could compromise this security, particularly through misconfigurations in the default subordinate ID settings.
Vulnerability Detail
The vulnerability, identified as CVE-2024-56433, arises from the default subordinate ID configuration in the /etc/login.defs file. This misconfiguration can potentially allow unauthorized users to gain access to sensitive user account information, leading to account compromise and unauthorized actions within the system. The CVSS score for this vulnerability is 3.6, indicating a low severity but still a significant risk that should be addressed promptly.
How To Fix
Minimum fixed version
2:4.9-15.el9
This is the first release that contains the fix.
sudo dnf update shadow-utilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can manually review and adjust the subordinate ID configurations in the /etc/login.defs file to ensure that they do not expose sensitive information. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The shadow-utils package is essential for managing user accounts securely in UNIX-like systems. The identified vulnerability (CVE-2024-56433) poses a risk due to default subordinate ID configurations. It is crucial to update the package to the latest version to protect against potential unauthorized access. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for shadow-utils →
FAQ
CVE-2024-56433 is a security vulnerability in the shadow-utils package that stems from a default subordinate ID configuration issue, potentially allowing unauthorized access to user account information.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access to user accounts, allowing attackers to perform actions with elevated privileges, which can compromise the integrity and security of the entire system.
Yes, a patch is available in the form of an updated version of the shadow-utils package (2:4.9-15.el9). It is recommended to update to this version to mitigate the risk.
If immediate updates are not possible, review and adjust the subordinate ID configurations in /etc/login.defs to minimize exposure. However, plan to update the package as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for shadow-utils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
