CVE-2023-4641
MediumSummary
A flaw in shadow-utils fails to properly clear the buffer when a new password is entered twice and the second attempt fails. This leaves the first password in memory, potentially allowing an attacker with sufficient access to retrieve it.
Risk Assessment
The risk involves potential leakage of user passwords, which could lead to unauthorized access to systems and sensitive data.
Recommendation
It is recommended to immediately update the shadow-utils package to the latest available version that includes a fix for this vulnerability.
Original NVD description (English source)
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from th