CVE-2023-4641

Name	CVE-2023-4641
Description	A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4130-1
Debian Bugs	1051062

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
shadow (PTS)	bullseye	1:4.8.1-1	vulnerable
	bullseye (security)	1:4.8.1-1+deb11u1	fixed
	bookworm	1:4.13+dfsg1-1+deb12u1	fixed
	trixie, sid	1:4.17.4-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
shadow	source	bullseye	1:4.8.1-1+deb11u1	DLA-4130-1
shadow	source	bookworm	1:4.13+dfsg1-1+deb12u1
shadow	source	(unstable)	1:4.13+dfsg1-2		1051062

Notes

[buster] - shadow <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2215945
https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904 (4.14.0-rc1)