USN-5745-2
shadow regression
USN-5745-1 fixed vulnerabilities in shadow. Unfortunately that update introduced a regression that caused useradd to behave incorrectly in Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. This update reverts the security fix pending further investigation.
We apologize for the inconvenience.
Original advisory details:
Florian Weimer discovered that shadow was not properly copying and removing user directory trees, which could lead to a race condition. A local attacker could possibly use this issue to setup a symlink attack and alter or remove directories without authorization.
What each source reports
OSV No score
shadow regression
USN-5745-1 fixed vulnerabilities in shadow. Unfortunately that update introduced a regression that caused useradd to behave incorrectly in Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. This update reverts the security fix pending further investigation.
We apologize for the inconvenience.
Original advisory details:
Florian Weimer discovered that shadow was not properly copying and removing user directory trees, which could lead to a race condition. A local attacker could possibly use this issue to setup a symlink attack and alter or remove directories without authorization.
- Record
USN-5745-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shadowUbuntu:Pro:14.04:LTS |
before 1:4.1.5.1-1ubuntu9.5+esm3, plus listed versions 1:4.1.5.1-1ubuntu61:4.1.5.1-1ubuntu71:4.1.5.1-1ubuntu81:4.1.5.1-1ubuntu91:4.1.5.1-1ubuntu9.1 Show 5 moreShow less1:4.1.5.1-1ubuntu9.21:4.1.5.1-1ubuntu9.41:4.1.5.1-1ubuntu9.51:4.1.5.1-1ubuntu9.5+esm11:4.1.5.1-1ubuntu9.5+esm2 |
1:4.1.5.1-1ubuntu9.5+esm3 |
shadowUbuntu:Pro:16.04:LTS |
before 1:4.2-3.1ubuntu5.5+esm3, plus listed versions 1:4.1.5.1-1.1ubuntu71:4.2-3.1ubuntu11:4.2-3.1ubuntu21:4.2-3.1ubuntu31:4.2-3.1ubuntu4 Show 6 moreShow less1:4.2-3.1ubuntu51:4.2-3.1ubuntu5.21:4.2-3.1ubuntu5.31:4.2-3.1ubuntu5.41:4.2-3.1ubuntu5.5+esm11:4.2-3.1ubuntu5.5+esm2 |
1:4.2-3.1ubuntu5.5+esm3 |
shadowUbuntu:18.04:LTS |
before 1:4.5-1ubuntu2.5, plus listed versions 1:4.2-3.2ubuntu41:4.5-1ubuntu11:4.5-1ubuntu21:4.5-1ubuntu2.21:4.5-1ubuntu2.31:4.5-1ubuntu2.4 |
1:4.5-1ubuntu2.5 |
shadowUbuntu:20.04:LTS |
before 1:4.8.1-1ubuntu5.20.04.4, plus listed versions 1:4.5-1.1ubuntu41:4.8-1ubuntu11:4.8.1-1ubuntu11:4.8.1-1ubuntu21:4.8.1-1ubuntu3 Show 6 moreShow less1:4.8.1-1ubuntu41:4.8.1-1ubuntu51:4.8.1-1ubuntu5.20.041:4.8.1-1ubuntu5.20.04.11:4.8.1-1ubuntu5.20.04.21:4.8.1-1ubuntu5.20.04.3 |
1:4.8.1-1ubuntu5.20.04.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-5745-2 is a vulnerability with no CVSS score yet in shadow, published November 29, 2022. No source lists public exploit code. Fixed in shadow 1:4.1.5.1-1ubuntu9.5+esm3.