Sylvain Beucler
7f6e0ec904
shadow (1:4.8.1-1+deb11u1) bullseye-security; urgency=high
.
* Non-maintainer upload by the LTS Security Team.
* CVE-2023-4641: When asking for a new password, shadow-utils asks the
password twice. If the password fails on the second attempt,
shadow-utils fails in cleaning the buffer used to store the first
entry. This may allow an attacker with enough access to retrieve the
password from the memory. (Closes: #1051062)
* CVE-2023-29383: It is possible to inject control characters into
fields provided to the SUID program chfn (change finger). Although it
is not possible to exploit this directly (e.g., adding a new user
fails because \n is in the block list), it is possible to misrepresent
the /etc/passwd file when viewed. (Closes: #1034482)
* Add Salsa-CI configuration.
* Silence lintian error that can't be fixed after freeze.
Small intro to the system for numbering the patches here... -The 00xx-... patches are forwarded to upstream's git repository -The 0xx_... series of patches are patches isolated from the latest version of the shadow Debian package not using quilt in order to separate upstream from Debian-specific stuff. NO MORE PATCHES SHOULD BE ADDED IN THESE SERIES -The 4xx series are patches which have been applied to Debian's shadow and have NOT been accepted and/or applied upstream. These patches MUST be kept even after resynced with upstream -The 5xx series are patches which are applied to Debian's shadow and will never be proposed upstream because they're too specific This list SHOULD BE AS SHORT AS POSSIBLE In short, while we are working towards synchronisation with upstream, our goal is to make 0xx patches disappear by moving them either to 3xx series (things already implemented upstream) or to 4xx series (Debian-specific patches).