CVE-2018-1113CWE-285

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells

Medium · published July 2, 2018

CVSS v3.0
4.8
EPSS
0%
Percentile
23.1
In the wild
Unconfirmed
What it is

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.

The record
Technical detail
CVSS v3.0
4.8 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.1th percentile
Weakness
CWE-285 · Improper Authorization
Published
2018-07-02T18:00Z
EPSS history
Timeline
  • 02 JUL 18:00Z
    setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells
    cvelistv5