{"id":"CVE-2024-56433","aliases":["ALSA-2025:20145","ALSA-2025:20559","AZL-54674","BELL-CVE-2024-56433","DEBIAN-CVE-2024-56433","EUVD-2024-53142","GHSA-7683-vm2j-m4cc","RHSA-2025:20145","RHSA-2025:20559","RLSA-2025:20145","RLSA-2025:20559","UBUNTU-CVE-2024-56433"],"status":"disputed","title":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g.,...","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","severity":{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00426,"percentile":0.37347,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1188"],"published":"2024-12-26T00:00:00Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"JonnyWhatshisface/CVE-2024-56433","title":"JonnyWhatshisface/CVE-2024-56433","date":"2025-01-03","url":"https://github.com/JonnyWhatshisface/CVE-2024-56433"}],"fixes":[{"ecosystem":"AlmaLinux:10","package":"shadow-utils","fixed_in":["2:4.15.0-8.el10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"shadow-utils-subid","fixed_in":["2:4.15.0-8.el10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"shadow-utils-subid-devel","fixed_in":["2:4.15.0-8.el10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"shadow-utils","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"shadow-utils-subid","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"shadow-utils-subid-devel","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"shadow-utils","fixed_in":["shadow-utils_4.18.0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"shadow","fixed_in":["4.17.3-r0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils","fixed_in":["2:4.15.0-8.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils-debuginfo","fixed_in":["2:4.15.0-8.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils-debugsource","fixed_in":["2:4.15.0-8.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils-subid","fixed_in":["2:4.15.0-8.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils-subid-debuginfo","fixed_in":["2:4.15.0-8.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils-subid-devel","fixed_in":["2:4.15.0-8.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shadow-utils","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shadow-utils-debuginfo","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shadow-utils-debugsource","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shadow-utils-subid","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shadow-utils-subid-debuginfo","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"shadow-utils-debuginfo","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"shadow-utils-debugsource","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"shadow-utils-subid-debuginfo","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"shadow-utils-subid-devel","fixed_in":["2:4.9-15.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"shadow-utils","fixed_in":["2:4.15.0-8.el10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"shadow-utils","fixed_in":["2:4.9-15.el9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"shadow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.0-8.el10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"shadow-utils-subid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.0-8.el10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"shadow-utils-subid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.0-8.el10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"shadow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"shadow-utils-subid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"shadow-utils-subid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"shadow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"shadow-utils_4.18.0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.13-r2"},{"fixed":"4.17.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.13+dfsg1-1","1:4.13+dfsg1-1+deb12u1","1:4.13+dfsg1-1+deb12u2","1:4.13+dfsg1-2","1:4.13+dfsg1-3","1:4.13+dfsg1-4","1:4.13+dfsg1-5","1:4.15.1-1","1:4.15.2-1","1:4.15.2-2","1:4.15.2-3","1:4.15.3-1","1:4.15.3-2","1:4.15.3-3","1:4.16.0-1","1:4.16.0-2","1:4.16.0-3","1:4.16.0-4","1:4.16.0-5","1:4.16.0-6","1:4.16.0-7","1:4.17.0-1","1:4.17.0~rc1-1","1:4.17.0~rc1-2","1:4.17.1-1","1:4.17.1-2","1:4.17.2-1","1:4.17.2-2","1:4.17.2-3","1:4.17.2-4","1:4.17.2-5","1:4.17.2-5+hurd.1","1:4.17.2-6","1:4.17.3-1","1:4.17.3-2","1:4.17.3-3","1:4.17.4-1","1:4.17.4-2","1:4.18.0-1","1:4.18.0-2","1:4.19.0-1","1:4.19.0-2","1:4.19.0-3","1:4.19.0-4","1:4.19.2-1","1:4.19.3-1","1:4.19.3-2","1:4.20.2-1","1:4.20.2-2","1:4.20.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.17.4-2","1:4.18.0-1","1:4.18.0-2","1:4.19.0-1","1:4.19.0-2","1:4.19.0-3","1:4.19.0-4","1:4.19.2-1","1:4.19.3-1","1:4.19.3-2","1:4.20.2-1","1:4.20.2-2","1:4.20.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.17.4-2","1:4.18.0-1","1:4.18.0-2","1:4.19.0-1","1:4.19.0-2","1:4.19.0-3","1:4.19.0-4","1:4.19.2-1","1:4.19.3-1","1:4.19.3-2","1:4.20.2-1","1:4.20.2-2","1:4.20.3-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.0-8.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.0-8.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.0-8.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils-subid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.0-8.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils-subid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.0-8.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"shadow-utils-subid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.0-8.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shadow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shadow-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shadow-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shadow-utils-subid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shadow-utils-subid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"shadow-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"shadow-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"shadow-utils-subid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"shadow-utils-subid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"shadow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.0-8.el10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"shadow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9-15.el9"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.5.1-1ubuntu6","1:4.1.5.1-1ubuntu7","1:4.1.5.1-1ubuntu8","1:4.1.5.1-1ubuntu9","1:4.1.5.1-1ubuntu9.1","1:4.1.5.1-1ubuntu9.2","1:4.1.5.1-1ubuntu9.4","1:4.1.5.1-1ubuntu9.5","1:4.1.5.1-1ubuntu9.5+esm1","1:4.1.5.1-1ubuntu9.5+esm2","1:4.1.5.1-1ubuntu9.5+esm3","1:4.1.5.1-1ubuntu9.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.5.1-1.1ubuntu7","1:4.2-3.1ubuntu1","1:4.2-3.1ubuntu2","1:4.2-3.1ubuntu3","1:4.2-3.1ubuntu4","1:4.2-3.1ubuntu5","1:4.2-3.1ubuntu5.2","1:4.2-3.1ubuntu5.3","1:4.2-3.1ubuntu5.4","1:4.2-3.1ubuntu5.5+esm1","1:4.2-3.1ubuntu5.5+esm2","1:4.2-3.1ubuntu5.5+esm3","1:4.2-3.1ubuntu5.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2-3.2ubuntu4","1:4.5-1ubuntu1","1:4.5-1ubuntu2","1:4.5-1ubuntu2.2","1:4.5-1ubuntu2.3","1:4.5-1ubuntu2.4","1:4.5-1ubuntu2.5","1:4.5-1ubuntu2.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.5-1.1ubuntu4","1:4.8-1ubuntu1","1:4.8.1-1ubuntu1","1:4.8.1-1ubuntu2","1:4.8.1-1ubuntu3","1:4.8.1-1ubuntu4","1:4.8.1-1ubuntu5","1:4.8.1-1ubuntu5.20.04","1:4.8.1-1ubuntu5.20.04.1","1:4.8.1-1ubuntu5.20.04.2","1:4.8.1-1ubuntu5.20.04.3","1:4.8.1-1ubuntu5.20.04.4","1:4.8.1-1ubuntu5.20.04.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.8.1-1ubuntu9","1:4.8.1-1ubuntu10","1:4.8.1-2ubuntu1","1:4.8.1-2ubuntu2","1:4.8.1-2ubuntu2.1","1:4.8.1-2ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.13+dfsg1-1ubuntu1","1:4.13+dfsg1-3ubuntu1","1:4.13+dfsg1-4ubuntu1","1:4.13+dfsg1-4ubuntu3","1:4.13+dfsg1-4ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.16.0-7ubuntu1","1:4.17.4-2ubuntu1","1:4.17.4-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.17.4-2ubuntu3","1:4.19.3-2ubuntu1","1:4.19.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.17.4-2ubuntu2","1:4.17.4-2ubuntu3"]}],"products":[{"vendor":"shadow-maint","product":"shadow-utils"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://github.com/shadow-maint/shadow/issues/1157","tags":["report","article"]},{"url":"https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","tags":["web","article","report"]},{"url":"https://github.com/shadow-maint/shadow/releases/tag/4.4","tags":["web","article","report"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-7683-vm2j-m4cc"},{"url":"https://access.redhat.com/errata/RHSA-2025:20145","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-56433","tags":["report"]},{"url":"https://bugzilla.redhat.com/2334165","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-20145.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:20559","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-20559.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-56433","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56433.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-56433","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.1_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-105943","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_20145.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2334165","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-56433","tags":["advisory","report"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.7_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-105945","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-70844","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-72940","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_20559.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:20145","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:20559","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-56433","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","status":"disputed","published":"2024-12-26T00:00:00Z","modified":"2026-10-15T00:59:14.221Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:33:57.638551Z"}],"euvd":[{"id":"EUVD-2024-53142","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","status":"published","published":"2024-12-26T00:00:00Z","modified":"2026-10-15T00:59:14Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:08.661475Z"}],"ghsa":[{"id":"GHSA-7683-vm2j-m4cc","title":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g.,...","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","status":"published","published":"2024-12-26T09:30:46Z","modified":"2026-10-15T03:34:22Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","status":"disputed","published":"2024-12-26T09:15:07.267Z","modified":"2026-10-15T01:19:16.297Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:10:41.091507Z"}],"osv":[{"id":"BELL-CVE-2024-56433","status":"published","published":"2024-12-27T05:56:54.494417Z","modified":"2026-01-26T09:41:10.850012Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:20.963569Z"},{"id":"CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","status":"published","published":"2024-12-26T00:00:00Z","modified":"2026-10-28T02:30:29.744679928Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T15:44:44.777182Z"},{"id":"DEBIAN-CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","status":"published","published":"2024-12-26T09:15:07.267Z","modified":"2026-11-02T12:03:08.140844868Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:44.429177Z"},{"id":"RHSA-2025:20145","title":"Red Hat Security Advisory: shadow-utils security update","status":"published","published":"2025-11-12T10:27:40Z","modified":"2026-06-30T10:21:33Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:20559","title":"Red Hat Security Advisory: shadow-utils security update","status":"published","published":"2025-11-11T10:07:41Z","modified":"2026-06-30T10:21:38Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RLSA-2025:20145","title":"Low: shadow-utils security update","description":"The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. \n\nSecurity Fix(es):\n\n* shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise (CVE-2024-56433)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.","status":"published","published":"2025-12-02T09:07:05.221797Z","modified":"2025-12-02T10:49:11.018941Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:20559","title":"Low: shadow-utils security update","description":"The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. \n\nSecurity Fix(es):\n\n* shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise (CVE-2024-56433)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2025-11-21T18:13:56.702188Z","modified":"2025-11-21T18:48:55.520933Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","status":"published","published":"2024-12-26T09:15:00Z","modified":"2026-10-17T12:56:45.866436471Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:15.331356Z"},{"id":"ALSA-2025:20145","title":"Low: shadow-utils security update","description":"The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts.   \n\nSecurity Fix(es):  \n\n  * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise (CVE-2024-56433)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2025-11-11T00:00:00Z","modified":"2026-10-29T11:58:12.087055Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:20559","title":"Low: shadow-utils security update","description":"The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts.   \n\nSecurity Fix(es):  \n\n  * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise (CVE-2024-56433)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2025-11-11T00:00:00Z","modified":"2026-10-29T11:32:28.480248274Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-54674","title":"CVE-2024-56433 affecting package shadow-utils for versions less than shadow-utils_4.18.0","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","status":"published","published":"2024-12-26T09:15:07Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:20.996398Z"}]}}