-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 18 Apr 2025 15:46:55 +0200
Source: shadow
Architecture: source
Version: 1:4.8.1-1+deb11u1
Distribution: bullseye-security
Urgency: high
Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
Changed-By: Sylvain Beucler <beuc@debian.org>
Closes: 1034482 1051062
Changes:
shadow (1:4.8.1-1+deb11u1) bullseye-security; urgency=high
.
* Non-maintainer upload by the LTS Security Team.
* CVE-2023-4641: When asking for a new password, shadow-utils asks the
password twice. If the password fails on the second attempt,
shadow-utils fails in cleaning the buffer used to store the first
entry. This may allow an attacker with enough access to retrieve the
password from the memory. (Closes: #1051062)
* CVE-2023-29383: It is possible to inject control characters into
fields provided to the SUID program chfn (change finger). Although it
is not possible to exploit this directly (e.g., adding a new user
fails because \n is in the block list), it is possible to misrepresent
the /etc/passwd file when viewed. (Closes: #1034482)
* Add Salsa-CI configuration.
* Silence lintian error that can't be fixed after freeze.
Checksums-Sha1:
316371d38200c5064ce10871df618af2bd3fe539 2247 shadow_4.8.1-1+deb11u1.dsc
63457a0ba58dc4e81b2663b839dc6c89d3343f12 1611196 shadow_4.8.1.orig.tar.xz
14d7ccaeddc77c4be7207c7fe8fa6f4d15e8cc7a 78248 shadow_4.8.1-1+deb11u1.debian.tar.xz
d6d0b02015464646a2855b7994c0eced4c7d3b4c 8523 shadow_4.8.1-1+deb11u1_amd64.buildinfo
Checksums-Sha256:
aaa0ac5c9639c762e9b459a7f0500fa7c24fa2aa37265ef5a30598add64ccc0e 2247 shadow_4.8.1-1+deb11u1.dsc
a3ad4630bdc41372f02a647278a8c3514844295d36eefe68ece6c3a641c1ae62 1611196 shadow_4.8.1.orig.tar.xz
68ce171dc78e6fc9c51da4b3a4c8f70b0927ab7e6c40cbebd67908be5ca27aaa 78248 shadow_4.8.1-1+deb11u1.debian.tar.xz
77cb85ad987c41278f65f39145904a4d4669644a344f8b717051d8ebeafdd63a 8523 shadow_4.8.1-1+deb11u1_amd64.buildinfo
Files:
b8cdabad6ddfaf5eeb5eab590951453e 2247 admin required shadow_4.8.1-1+deb11u1.dsc
4b05eff8a427cf50e615bda324b5bc45 1611196 admin required shadow_4.8.1.orig.tar.xz
fe5e2b8b3144a6609a2d8ea16c3bceef 78248 admin required shadow_4.8.1-1+deb11u1.debian.tar.xz
a3d55a700514e2c77af6b74bfbc6ac9a 8523 admin required shadow_4.8.1-1+deb11u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmgCnq0ACgkQDTl9HeUl
XjDWAg/+KrGC2B9aSz/F7mfWkngT1nXb+a8JZ3cDEqtdVwv3PTcchqWUT43KH0a1
kC8UjK1IOhXC3COSfKbElKxs0gGOGjtXp+h1d6jonIe6LqgRHhwtGaEAraX2pLVz
c6nKm/tGegNEiN2hsNyxrguGqaCA6lFRbTB0Ie7MOAD5puQ759GQlt+HZHSi+e0q
d8CSg6T4ZN+ASb67JsWFZtFSqponVOEd08uAwyXX1T7nub4kkOVbqcUPpQzxt8ru
c/SjudJhj+htwJwg1pkyp/H4RNEC5Iw5/L6/OE3yv6P8iuB+99UtaWFGEzZ+SLn8
2vObvNCCmVuRtK76jNC8noZ7riJ2ugqLs+PfrOEXOEaaqzPOFhd7d3soaXJc8QBX
wMWjU1JeDXN5Utv2gerUhrD2CYcts6YZ4NkprZAE8kWz4xPPQPsNw/xO5vd7nqqN
dOCTOPOwY6F8TFUge1iT9dBOxYQUB0V+5V9vM3JmIJznW0yW9Ag9Yqio+rwg545x
JKRCx7/dpZBgUTLJbpczqChrrXXMac181XS0+CFyQd64ByVIUAitzoWiNtTIfAo+
wz1XG4H9iNDi4JqzDpiCbgOUE0GTYSja5pXRWMvd5RPStq9OXM5jyOmj64sBg2m0
RHpnvrpmtVLSgZOiKtk04GTFqkSuNZ0jJAx6kBGlxHqROCzmsOA=
=lFN2
-----END PGP SIGNATURE-----
Attachment:
pgpkWQ5jZjeiJ.pgp
Description: PGP signature