Source: shadow Version: 1:4.13+dfsg1-1 Severity: important Tags: security upstream Forwarded: https://github.com/shadow-maint/shadow/pull/687 X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for shadow. CVE-2023-29383[0]: | In Shadow 4.13, it is possible to inject control characters into | fields provided to the SUID program chfn (change finger). Although it | is not possible to exploit this directly (e.g., adding a new user | fails because \n is in the block list), it is possible to misrepresent | the /etc/passwd file when viewed. Use of \r manipulations and Unicode | characters to work around blocking of the : character make it possible | to give the impression that a new user has been added. In other words, | an adversary may be able to convince a system administrator to take | the system offline (an indirect, social-engineered denial of service) | by demonstrating that "cat /etc/passwd" shows a rogue user account. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-29383 https://www.cve.org/CVERecord?id=CVE-2023-29383 [1] https://github.com/shadow-maint/shadow/pull/687 [2] https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d Please adjust the affected versions in the BTS as needed. Regards, Salvatore
