2271585 – (CVE-2024-2905) CVE-2024-2905 rpm-ostree: world-readable /etc/shadow file

Bug 2271585 (CVE-2024-2905) - CVE-2024-2905 rpm-ostree: world-readable /etc/shadow file

Summary: CVE-2024-2905 rpm-ostree: world-readable /etc/shadow file

Keywords:
Status:	CLOSED CURRENTRELEASE
Alias:	CVE-2024-2905
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2274140
Blocks:	2271586
TreeView+	depends on / blocked

Reported:	2024-03-26 12:15 UTC by TEJ RATHI
Modified:	2025-02-06 16:36 UTC (History)
CC List:	14 users (show)
Fixed In Version:	rpm-ostree-2024.4
Clone Of:
Environment:
Last Closed:	2025-02-06 16:36:41 UTC
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2024:3401	0	None	None	None	2024-05-28 14:26:32 UTC
Red Hat Product Errata	RHSA-2024:3823	0	None	None	None	2024-06-11 19:40:27 UTC

Description TEJ RATHI 2024-03-26 12:15:57 UTC

A vulnerability has been identified in rpm-ostree, where /etc/shadow file in a default build has the world-readable bit enabled. It is due to higher permissions enabled by default than recommended. 

https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6
https://issues.redhat.com/browse/OCPBUGS-30732

Comment 3 Sandipan Roy 2024-04-09 11:05:57 UTC

Created rpm-ostree tracking bugs for this issue:

Affects: fedora-all [bug 2274140]

Comment 4 Fedora Update System 2024-04-10 04:05:11 UTC

FEDORA-2024-4afd3d38ae (rpm-ostree-2024.4-6.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 errata-xmlrpc 2024-05-28 14:26:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:3401 https://access.redhat.com/errata/RHSA-2024:3401

Comment 7 errata-xmlrpc 2024-06-11 19:40:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:3823 https://access.redhat.com/errata/RHSA-2024:3823

Comment 9 Timothée Ravier 2025-02-06 16:36:41 UTC

I think this issue has been fixed everywhere now so it should be safe to close it. Thanks

Note You need to log in before you can comment on or make changes to this bug.