SUSE has issued an advisory today (September 13): https://www.suse.com/support/update/announcement/2023/suse-su-20233591-1/
Whiteboard: (none) => MGA9TOO, MGA8TOOSource RPM: (none) => shadow-utils-4.13-1.mga9.src.rpmCC: (none) => nicolas.salguero
The advisory-bugzilla entry shows shadow-4.8.1 as the fix... which we have had since Aug 2021. Assigning globally as no packager in view for this SRPM.
Status comment: (none) => ? Fix v4.8.1Assignee: bugsquad => pkg-bugs
Status comment: ? Fix v4.8.1 => Fix in version 4.14.0-rc1
Suggested advisory: ======================== The updated packages fix a security vulnerability: Potential password leak. (CVE-2023-4641) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4641 https://www.suse.com/support/update/announcement/2023/suse-su-20233591-1/ ======================== Updated packages in 9/core/updates_testing: ======================== lib64subid4-4.13-1.1.mga9 lib64subid-devel-4.13-1.1.mga9 shadow-utils-4.13-1.1.mga9 from SRPM: shadow-utils-4.13-1.1.mga9.src.rpm Updated package in 8/core/updates_testing: ======================== shadow-utils-4.6-4.2.mga8 from SRPM: shadow-utils-4.6-4.2.mga8.src.rpm
Assignee: pkg-bugs => nicolas.salgueroWhiteboard: MGA9TOO, MGA8TOO => MGA8TOOStatus comment: Fix in version 4.14.0-rc1 => (none)Version: Cauldron => 9Status: NEW => ASSIGNED
Assignee: nicolas.salguero => qa-bugs
MGA8-64 Xfce on Acer Aspire 5253 No installation issues. Ref bug 31198 Comment 8 # useradd prutser # getent passwd {1000..60000} tester8:x:1000:1000:Tester8:/home/tester8:/bin/bash prutser:x:1001:1001::/home/prutser:/bin/bash [root@mach7 ~]# usermod -p pruts prutser Now as normal user in second terminal tab $ su -l prutser Password: su: Authentication failure repeated to exclude finger trouble, no avail Used MCC to handle users, prutser is there, changed password to pruts there and then the su command works $ su -l prutser Password: [prutser@mach7 ~]$ pwd /home/prutser Continuing test # userdel prutser userdel: user prutser is currently used by process 9350 That's right, prutser is still logged in in the other terminal tab Giving the exit command there and then # userdel prutser no feedback, that's OK Checked in MCC, prutser is gone # getent passwd {1000..60000} tester8:x:1000:1000:Tester8:/home/tester8:/bin/bash Can someone explain why I couldn't login after the usermod command???
CC: (none) => herman.viaene
MGA9-64 Xfce on Acer Aspire 5253 No installation issues. Exactly the same commands and results as in Comment 3 above. If someone could explain why the uermod command does not give the result I expected, I will give the OK, but for now I don''t trust this behavior.