CVE-2023-4641
Shadow-utils: possible password leak during passwd(1) change
概要
Shadow-utils: possible password leak during passwd(1) change
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-4641 shadow 修正版: 1:4.8.1-1+deb11u1
参照URL
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- report bugzilla.redhat.com
- web access.redhat.com
- web lists.debian.org