USN-6640-1: shadow vulnerability | Ubuntu security notices

Packages

shadow - system login tools

Details

It was discovered that shadow was not properly sanitizing memory when
running the password utility. An attacker could possibly use this issue
to retrieve a password from memory, exposing sensitive information.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
23.10 mantic	libsubid-dev – 1:4.13+dfsg1-1ubuntu1.1
	libsubid4 – 1:4.13+dfsg1-1ubuntu1.1
	login – 1:4.13+dfsg1-1ubuntu1.1
	passwd – 1:4.13+dfsg1-1ubuntu1.1
	uidmap – 1:4.13+dfsg1-1ubuntu1.1
22.04 jammy	login – 1:4.8.1-2ubuntu2.2
	passwd – 1:4.8.1-2ubuntu2.2
	uidmap – 1:4.8.1-2ubuntu2.2
20.04 focal	login – 1:4.8.1-1ubuntu5.20.04.5
	passwd – 1:4.8.1-1ubuntu5.20.04.5
	uidmap – 1:4.8.1-1ubuntu5.20.04.5
18.04 bionic	login – 1:4.5-1ubuntu2.5+esm1
	passwd – 1:4.5-1ubuntu2.5+esm1
	uidmap – 1:4.5-1ubuntu2.5+esm1
16.04 xenial	login – 1:4.2-3.1ubuntu5.5+esm4
	passwd – 1:4.2-3.1ubuntu5.5+esm4
	uidmap – 1:4.2-3.1ubuntu5.5+esm4
14.04 trusty	login – 1:4.1.5.1-1ubuntu9.5+esm4
	passwd – 1:4.1.5.1-1ubuntu9.5+esm4
	uidmap – 1:4.1.5.1-1ubuntu9.5+esm4

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

CVE-2023-4641

CVE-2023-4641