Bug 2271585 (CVE-2024-2905) - CVE-2024-2905 rpm-ostree: world-readable /etc/shadow file
Summary: CVE-2024-2905 rpm-ostree: world-readable /etc/shadow file
Keywords:
Status: NEW
Alias: CVE-2024-2905
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2274140
Blocks: 2271586
TreeView+ depends on / blocked
 
Reported: 2024-03-26 12:15 UTC by TEJ RATHI
Modified: 2024-05-28 14:26 UTC (History)
14 users (show)

Fixed In Version: rpm-ostree-2024.4
Doc Type: If docs needed, set a value
Doc Text:
A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:3401 0 None None None 2024-05-28 14:26:32 UTC

Description TEJ RATHI 2024-03-26 12:15:57 UTC 
A vulnerability has been identified in rpm-ostree, where /etc/shadow file in a default build has the world-readable bit enabled. It is due to higher permissions enabled by default than recommended. 

https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6
https://issues.redhat.com/browse/OCPBUGS-30732
Comment 3 Sandipan Roy 2024-04-09 11:05:57 UTC 
Created rpm-ostree tracking bugs for this issue:

Affects: fedora-all [bug 2274140]
Comment 4 Fedora Update System 2024-04-10 04:05:11 UTC 
FEDORA-2024-4afd3d38ae (rpm-ostree-2024.4-6.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 6 errata-xmlrpc 2024-05-28 14:26:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:3401 https://access.redhat.com/errata/RHSA-2024:3401
Note You need to log in before you can comment on or make changes to this bug.