{"action":"Upgrade grub2 to 2.00-20 or later.","affected":[{"fixed":"2.00-20","introduced":"0"}],"component":"grub2","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["2.00-20"],"id":"tcs_01M5NAJ4SY71JV34KYFJ3THP8S","modified_at":"2026-09-01T20:03:18.582722585Z","published_at":"2014-05-12T14:55:05.023Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2013-4577","https://security-tracker.debian.org/tracker/CVE-2013-4577"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2013-4577#Debian:13/grub2","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2013-4577"}],"summary":"A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the password_pbkdf2 directive in the fi"}