OESA-2023-1687

    Dashboard / Vulnerabilities / OESA-2023-1687

    OESA-2023-1687

    Published: 28 Sept 2023Last Modified: 18 Aug 2026
    Upstream:
    CVE-2023-4641

    Summary: shadow security update

    Details: This package includes the necessary programs for converting plain password files to the shadow password format and to manage user and group accounts. Security Fix(es): When gpasswd(1) asks for the new password, it asks twice (as is usual for confirming the new password). Each of those 2 password prompts uses agetpass() to get the password. If the second agetpass() fails, the first password, which has been copied into the 'static' buffer 'pass' via STRFCPY(), wasn't being zeroed.(CVE-2023-4641)

    References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1687, https://nvd.nist.gov/vuln/detail/CVE-2023-4641

    Affected packages

    Package

    Name: shadow

    Purl: pkg:rpm/openEuler/shadow&distro=openEuler-20.03-LTS-SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.8.1-9.oe1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2023-1687 | CVE-DB