Alpine/shadow: low 3.3
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user
Action: Upgrade shadow to 4.13-r4 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.13-r4 | - |
Fixed versions
| 4.13-r4 |
Sources
published · modified · JSON