CVE-2024-2905
Fixed in a distro release EPSS <1%CVSS 6.2
A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 10.0 | rpm-ostree | 0:2025.5-1.el10 |
| Red Hat Enterprise Linux 10.0 | rpm-ostree-debuginfo | 0:2025.5-1.el10 |
| Red Hat Enterprise Linux 10.0 | rpm-ostree-debugsource | 0:2025.5-1.el10 |
| Red Hat Enterprise Linux 10.0 | rpm-ostree-libs | 0:2025.5-1.el10 |
| Red Hat Enterprise Linux 10.0 | rpm-ostree-libs-debuginfo | 0:2025.5-1.el10 |
| Red Hat Enterprise Linux 9 | rpm-ostree | 0:2024.3-3.el9_4 |
| Red Hat Enterprise Linux 9 | rpm-ostree-debuginfo | 0:2024.3-3.el9_4 |
| Red Hat Enterprise Linux 9 | rpm-ostree-debugsource | 0:2024.3-3.el9_4 |
| Red Hat Enterprise Linux 9 | rpm-ostree-libs | 0:2024.3-3.el9_4 |
| Red Hat Enterprise Linux 9 | rpm-ostree-libs-debuginfo | 0:2024.3-3.el9_4 |
| Red Hat rhel eus 9.2 | rpm-ostree | 0:2023.3-2.el9_2 |
| Red Hat rhel eus 9.2 | rpm-ostree-debuginfo | 0:2023.3-2.el9_2 |
| Red Hat rhel eus 9.2 | rpm-ostree-debugsource | 0:2023.3-2.el9_2 |
| Red Hat rhel eus 9.2 | rpm-ostree-libs | 0:2023.3-2.el9_2 |
| Red Hat rhel eus 9.2 | rpm-ostree-libs-debuginfo | 0:2023.3-2.el9_2 |