CVE-2023-4641

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

This package includes the necessary programs for converting plain password files to the shadow password format and to manage user and group accounts.

Security Fix(es):

When gpasswd(1) asks for the new password, it asks twice (as is usual for confirming the new password). Each of those 2 password prompts uses agetpass() to get the password. If the second agetpass() fails, the first password, which has been copied into the 'static' buffer 'pass' via STRFCPY(), wasn't being zeroed.(CVE-2023-4641)

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts.

Security Fix(es):

• shadow-utils: possible password leak during passwd(1) change (CVE-2023-4641)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts.

Security Fix(es):

• shadow-utils: possible password leak during passwd(1) change (CVE-2023-4641)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2023-4641: fix buffer cleaning issue when password fails on second attempt

• CVE-2023-4641: fix password leak in gpasswd

• CVE-2023-4641: fix password leak in gpasswd

• CVE-2023-4641: fix password leak in gpasswd

The updated packages fix a security vulnerability:

Potential password leak. (CVE-2023-4641)

These are all security issues fixed in the libsubid-devel-4.19.2-2.1 package on the GA media of openSUSE Tumbleweed.

This update for shadow fixes the following issues:

shadow is updated to 4.17.2 to bring lots of features and bug fixes.

• util-linux-2.41 introduced new variable: LOGIN_ENV_SAFELIST. Recognize it and update dependencies.

• Set SYS_{UID,GID}_MIN to 201: After repeated similar requests to change the ID ranges we set the above mentioned value to 201. The max value will stay at 499. This range should be sufficient and will give us leeway for the future. It's not straightforward to find out which static UIDs/GIDs are used in all packages.

Update to 4.17.2:

• src/login_nopam.c: Fix compiler warnings #1170
• lib/chkname.c: Put limits for LOGIN_NAME_MAX and sysconf(_SC_LOGIN_NAME_MAX) #1169
• Use HTTPS in link to Wikipedia article on password strength #1164
• lib/attr.h: use C23 attributes only with gcc >= 10 #1172
• login: Fix no-pam authorization regression #1174
• man: Add Portuguese translation #1178
• Update French translation #1177
• Add cheap defense mechanisms #1171
• Add Romanian translation #1176

Update to 4.17.1:

• Fix su - regression #1163

Update to 4.17.0:

• Fix the lower part of the domain of csrand_uniform()
• Fix use of volatile pointer
• Use str2[u]l() instead of atoi(3)
• Use a2i() in various places
• Fix const correctness
• Use uid_t for holding UIDs (and GIDs)
• Move all sprintf(3)-like APIs to a subdirectory
• Move all copying APIs to a subdirectory
• Fix forever loop on ENOMEM
• Fix REALLOC() nmemb calculation
• Remove id(1)
• Remove groups(1)
• Use local time for human-readable dates
• Use %F instead of %Y-%m-%d with strftime(3)
• is_valid{user,group}_name(): Set errno to distinguish the reasons
• Recommend --badname only if it is useful
• Add fmkomstemp() to fix mode of /etc/default/useradd
• Fix use-after-free bug in sgetgrent()
• Update Catalan translation
• Remove references to cppw, cpgr
• groupadd, groupmod: Update gshadow file with -U
• Added option -a for listing active users only, optimized using if aflg,return
• Added information in lastlog man page for new option '-a'
• Plenty of code cleanup and clarifications

• Disable flushing sssd caches. The sssd's files provider is no longer available.

Update to 4.16.0:

• The shadow implementations of id(1) and groups(1) are deprecated in favor of the GNU coreutils and binutils versions. They will be removed in 4.17.0.
• The rlogind implementation has been removed.
• The libsubid major version has been bumped, since it now requires specification of the module's free() implementation.

Update to 4.15.1:

• Fix a bug that caused spurious error messages about unknown login.defs configuration options #967
• Adding checks for fd omission #964
• Use temporary stat buffer #974
• Fix wrong french translation #975

Update to 4.15.0

• libshadow:
  • Use utmpx instead of utmp. This fixes a regression introduced in 4.14.0.
  • Fix build error (parameter name omitted).
• Build system:
  • Link correctly with libdl.
  • Install pam configs for chpasswd(8) and newusers(8) when using ./configure --with-libpam --disable-account-tools-setuid.
  • Merge libshadow and libmisc into a single libshadow. This fixes problems in the linker, which were reported at least in Gentoo.
  • Fix build with musl libc.
  • Support out of tree builds
• useradd(8):
  • Set proper SELinux labels for def_usrtemplate

Update to 4.14.6:

• login(1):
  • Fix off-by-one bugs.
• passwd(1):
  • Don't silently truncate passwords of length >= 200 characters. Instead, accept a length of PASS_MAX, and reject longer ones.
• libshadow:
  • Fix calculation in strtoday(), which caused a wrong half-day offset in some cases (bsc#1176006)
  • Fix parsing of dates in get_date() (bsc#1176006)
  • Use utmpx instead of utmp. This fixes a regression introduced in 4.14.0.

Update to 4.14.5:

• Build system:
  • Fix regression introduced in 4.14.4, due to a typo. chgpasswd had been deleted from a Makefile variable, but it should have been …

This update for shadow fixes the following issues:

• CVE-2023-4641: Fixed potential password leak (bsc#1214806).

This update for shadow fixes the following issues:

• CVE-2023-4641: Fixed potential password leak (bsc#1214806).

This update for shadow fixes the following issues:

• CVE-2023-4641: Fixed potential password leak (bsc#1214806).

This update for shadow fixes the following issues:

• CVE-2023-4641: Fixed potential password leak (bsc#1214806).

This update for shadow fixes the following issues:

• CVE-2023-4641: Fixed potential password leak (bsc#1214806).

This update for shadow fixes the following issues:

• CVE-2023-29383: Fixed apparent /etc/shadow manipulation via chfn (bsc#1210507).
• CVE-2023-4641: Fixed possible password leak during passwd(1) change (bsc#1214806).

The following non-security bugs were fixed:

• bsc#1176006: Fix chage date miscalculation
• bsc#1188307: Fix passwd segfault
• bsc#1203823: Remove pam_keyinit from PAM config files
• bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions
• bsc#1206627: Add --prefix support to passwd, chpasswd and chage
• bsc#1205502: useradd audit event user id field cannot be interpretedd

This update for shadow fixes the following issues:

• CVE-2023-29383: Fixed apparent /etc/shadow manipulation via chfn (bsc#1210507).
• CVE-2023-4641: Fixed possible password leak during passwd(1) change (bsc#1214806).

The following non-security bugs were fixed:

• bsc#1176006: Fix chage date miscalculation
• bsc#1188307: Fix passwd segfault
• bsc#1203823: Remove pam_keyinit from PAM config files
• bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions
• bsc#1206627: Add --prefix support to passwd, chpasswd and chage
• bsc#1205502: useradd audit event user id field cannot be interpretedd

It was discovered that shadow was not properly sanitizing memory when running the password utility. An attacker could possibly use this issue to retrieve a password from memory, exposing sensitive information.