7f6e0ec904
shadow (1:4.8.1-1+deb11u1) bullseye-security; urgency=high
.
* Non-maintainer upload by the LTS Security Team.
* CVE-2023-4641: When asking for a new password, shadow-utils asks the
password twice. If the password fails on the second attempt,
shadow-utils fails in cleaning the buffer used to store the first
entry. This may allow an attacker with enough access to retrieve the
password from the memory. (Closes: #1051062)
* CVE-2023-29383: It is possible to inject control characters into
fields provided to the SUID program chfn (change finger). Although it
is not possible to exploit this directly (e.g., adding a new user
fails because \n is in the block list), it is possible to misrepresent
the /etc/passwd file when viewed. (Closes: #1034482)
* Add Salsa-CI configuration.
* Silence lintian error that can't be fixed after freeze.
A testsuite is also available. Instruction on how to run this testsuite are available in tests/README -- Balint Reczey <rbalint@ubuntu.com>, Sat, 12 Aug 2017 18:46:44 -0400