CVE Feed

    Dashboard / CVE / CVE-2023-4641

    CVE-2023-4641

    A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

    Published:Jun 17, 2023
    Last Modified:Nov 3, 2025
    EPS:Dec 27, 2023
    EPSS Score:0.00015
    CVSS Score:4.7

    Affected Products

    Vendor
    Redhat
    Product
    Codeready Linux Builder
    Vendor
    Redhat
    Product
    Codeready Linux Builder For Arm64
    Vendor
    Redhat
    Product
    Codeready Linux Builder For Ibm Z Systems
    Vendor
    Redhat
    Product
    Codeready Linux Builder For Power Little Endian
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Enterprise Linux For Arm 64
    Vendor
    Redhat
    Product
    Enterprise Linux For Ibm Z Systems
    Vendor
    Redhat
    Product
    Enterprise Linux For Power Little Endian
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Shadow-maint
    Product
    Shadow-utils

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-13601 (CVSS 7.7) — A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the …
    CVE-2025-3155 (CVSS 7.4) — A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary script…
    CVE-2025-2784 (CVSS 7) — A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via th…
    CVE-2023-3758 (CVSS 7.1) — A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated use…
    CVE-2024-1488 (CVSS 8) — A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the un…
    CVE-2023-5455 (CVSS 6.5) — A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of I…
    CVE-2024-0193 (CVSS 7.8) — A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is gar…
    CVE-2023-4911 (CVSS 7.8) — A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABL…
    CVE-2023-5633 (CVSS 7.8) — The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-fr…
    CVE-2023-4732 (CVSS 4.7) — A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High