CVE-2023-4641CWE-303

Shadow-utils: possible password leak during passwd(1) change

Medium · published December 27, 2023

CVSS v3.1
4.7
EPSS
0%
Percentile
16.3
In the wild
Unconfirmed
What it is

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00256 · 16.3th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2023-12-27T15:43Z
EPSS history
Timeline
  • 27 DEC 15:43Z
    Shadow-utils: possible password leak during passwd(1) change
    cvelistv5