Every CVE Search/ Get API key

CVE-2024-2905

Rpm-ostree: world-readable /etc/shadow file

6.2 MediumFix available

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.33%Up 0.3 points since Apr 26, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.2

Rpm-ostree: world-readable /etc/shadow file

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.

Record
CVE-2024-2905
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-732
Updated
2026-11-07
EUVDEUVD-2024-27849 6.2

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.

Record
EUVD-2024-27849
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-07
NVD 6.2

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.

Record
CVE-2024-2905
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-732
Updated
2026-11-07
OSVRHBA-2025:4872 6.2

Red Hat Bug Fix Advisory: rpm-ostree bug fix and enhancement update

Record
RHBA-2025:4872
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:3401 6.2

Red Hat Security Advisory: rpm-ostree security update

Record
RHSA-2024:3401
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:3823 6.2

Red Hat Security Advisory: rpm-ostree security update

Record
RHSA-2024:3823
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2024:3823 No score

Moderate: rpm-ostree security update

The rpm-ostree tool binds together the RPM packaging model with the OSTree model of bootable file system trees. It provides commands that can be used both on client systems and on server-side composes. The rpm-ostree-client package provides commands for client systems to perform upgrades and rollbacks.

Security Fix(es):

  • rpm-ostree: world-readable /etc/shadow file [9.4.z] (JIRA:AlmaLinux-31852)
Record
ALSA-2024:3823
Updated
2026-11-02
OSVAZL-42310 No score

CVE-2024-2905 affecting package rpm-ostree for versions less than 2024.4-3

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.

Record
AZL-42310
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rpm-ostree
AlmaLinux:9
 before 2024.3-3.el9_4
2024.3-3.el9_4
rpm-ostree-libs
AlmaLinux:9
 before 2024.3-3.el9_4
2024.3-3.el9_4
rpm-ostree
Azure Linux:3
 before 2024.4-3
2024.4-3
rpm-ostree
Red Hat:enterprise_linux:10.0
 before 0:2025.5-1.el10
0:2025.5-1.el10
rpm-ostree-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:2025.5-1.el10
0:2025.5-1.el10
rpm-ostree-debugsource
Red Hat:enterprise_linux:10.0
 before 0:2025.5-1.el10
0:2025.5-1.el10
rpm-ostree-libs
Red Hat:enterprise_linux:10.0
 before 0:2025.5-1.el10
0:2025.5-1.el10
rpm-ostree-libs-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:2025.5-1.el10
0:2025.5-1.el10
rpm-ostree
Red Hat:rhel_eus:9.2::appstream
 before 0:2023.3-2.el9_2
0:2023.3-2.el9_2
rpm-ostree-debuginfo
Red Hat:rhel_eus:9.2::appstream
 before 0:2023.3-2.el9_2
0:2023.3-2.el9_2
Show 8 moreShow less
Affected packages
PackageAffectedFixed
rpm-ostree-debugsource
Red Hat:rhel_eus:9.2::appstream
 before 0:2023.3-2.el9_2
0:2023.3-2.el9_2
rpm-ostree-libs
Red Hat:rhel_eus:9.2::appstream
 before 0:2023.3-2.el9_2
0:2023.3-2.el9_2
rpm-ostree-libs-debuginfo
Red Hat:rhel_eus:9.2::appstream
 before 0:2023.3-2.el9_2
0:2023.3-2.el9_2
rpm-ostree
Red Hat:enterprise_linux:9::appstream
 before 0:2024.3-3.el9_4
0:2024.3-3.el9_4
rpm-ostree-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2024.3-3.el9_4
0:2024.3-3.el9_4
rpm-ostree-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:2024.3-3.el9_4
0:2024.3-3.el9_4
rpm-ostree-libs
Red Hat:enterprise_linux:9::appstream
 before 0:2024.3-3.el9_4
0:2024.3-3.el9_4
rpm-ostree-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2024.3-3.el9_4
0:2024.3-3.el9_4

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-2905 is a medium vulnerability (CVSS 6.2) in Red Hat Enterprise Linux 10, published April 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in rpm-ostree 2024.3-3.el9_4.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open