Bug 2271585 (CVE-2024-2905)

Summary:	CVE-2024-2905 rpm-ostree: world-readable /etc/shadow file
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cverna, dfreiber, drow, dustymabe, jburrell, jlebon, jtrystra, miabbott, pwhalen, security-response-team, sidakwo, travier, vkumar, walters
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rpm-ostree-2024.4	Doc Type:	If docs needed, set a value
Doc Text:	A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-02-06 16:36:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2274140
Bug Blocks:	2271586

Description TEJ RATHI 2024-03-26 12:15:57 UTC

A vulnerability has been identified in rpm-ostree, where /etc/shadow file in a default build has the world-readable bit enabled. It is due to higher permissions enabled by default than recommended. 

https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6
https://issues.redhat.com/browse/OCPBUGS-30732

Comment 3 Sandipan Roy 2024-04-09 11:05:57 UTC

Created rpm-ostree tracking bugs for this issue:

Affects: fedora-all [bug 2274140]

Comment 4 Fedora Update System 2024-04-10 04:05:11 UTC

FEDORA-2024-4afd3d38ae (rpm-ostree-2024.4-6.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 errata-xmlrpc 2024-05-28 14:26:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:3401 https://access.redhat.com/errata/RHSA-2024:3401

Comment 7 errata-xmlrpc 2024-06-11 19:40:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:3823 https://access.redhat.com/errata/RHSA-2024:3823

Comment 9 Timothée Ravier 2025-02-06 16:36:41 UTC

I think this issue has been fixed everywhere now so it should be safe to close it. Thanks