CVE-2023-4641

Katalog CVE

CVSS 5.5 · Medium EPSS 0,26%

Kerentanan Incorrect Implementation of Authentication Algorithm pada shadow-maint shadow-utils, redhat codeready linux builder +7 lainnya. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

Rincian

Terbit di NVD

27 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-303: Incorrect Implementation of Authentication Algorithm
CWE-287: Improper Authentication

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 15,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2023:6632 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2023:7112 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2023-4641 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2024:0417
• https://access.redhat.com/errata/RHSA-2024:2577
• https://bugzilla.redhat.com/show_bug.cgi?id=2215945 issue tracking
• https://lists.debian.org/debian-lts-announce/2025/04/msg00026.html