A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:6632 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:7112 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2023-4641 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2215945 | Issue Tracking |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
04 Jan 2024, 17:06
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:8.0_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* cpe:2.3:a:shadow-maint:shadow-utils:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:* |
|
| References | () https://access.redhat.com/errata/RHSA-2023:6632 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:7112 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2023-4641 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2215945 - Issue Tracking | |
| CWE | CWE-287 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| Summary |
|
|
| First Time |
Redhat enterprise Linux
Redhat codeready Linux Builder For Ibm Z Systems Redhat enterprise Linux For Ibm Z Systems Redhat enterprise Linux For Arm 64 Redhat Shadow-maint shadow-utils Redhat enterprise Linux For Power Little Endian Redhat codeready Linux Builder Redhat codeready Linux Builder For Power Little Endian Redhat codeready Linux Builder For Arm64 Shadow-maint |
27 Dec 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-27 16:15
Updated : 2024-01-04 17:06
NVD link : CVE-2023-4641
Mitre link : CVE-2023-4641
CVE.ORG link : CVE-2023-4641
JSON object : View
Products Affected
redhat
- enterprise_linux_for_ibm_z_systems
- codeready_linux_builder_for_power_little_endian
- codeready_linux_builder
- enterprise_linux_for_arm_64
- enterprise_linux
- enterprise_linux_for_power_little_endian
- codeready_linux_builder_for_ibm_z_systems
- codeready_linux_builder_for_arm64
shadow-maint
- shadow-utils