CVE catalog

CVE-2018-7169

shadow: CVE-2018-7169

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.57% · Oct 25, 2026

An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianshadowsid1:4.20.3-1fixed
Debianshadowforky1:4.20.3-1fixed
Debianshadowtrixie1:4.17.4-2fixed
Debianshadowbookworm1:4.13+dfsg1-1+deb12u2fixed
Ubuntushadowpro1:4.1.5.1-1.1ubuntu7vulnerable
Ubuntushadowpro1:4.2-3.1ubuntu1vulnerable
Ubuntushadowpro1:4.2-3.1ubuntu2vulnerable
Ubuntushadowpro1:4.2-3.1ubuntu3vulnerable
Ubuntushadowpro1:4.2-3.1ubuntu4vulnerable
Ubuntushadowpro1:4.2-3.1ubuntu5vulnerable
Ubuntushadowpro1:4.2-3.1ubuntu5.2vulnerable
Ubuntushadowpro1:4.2-3.1ubuntu5.3vulnerable
Ubuntushadowpro1:4.2-3.1ubuntu5.4vulnerable
Ubuntushadowpro1:4.2-3.1ubuntu5.5+esm1fixed
Ubuntushadow18.041:4.2-3.2ubuntu4vulnerable
Ubuntushadow18.041:4.5-1ubuntu1vulnerable
Ubuntushadow18.041:4.5-1ubuntu2vulnerable
Ubuntushadow18.041:4.5-1ubuntu2.2fixed
Opensuseshadowtumbleweed4.9-1.1fixed
Suseshadowlinux enterprise desktop 12 sp24.2.1-27.6.1fixed
Suseshadowlinux enterprise desktop 12 sp34.2.1-27.6.1fixed
Suseshadowlinux enterprise server for raspberry pi 12 sp24.2.1-27.6.1fixed
Suseshadowlinux enterprise server 12 sp24.2.1-27.6.1fixed
Suseshadowlinux enterprise server for sap applications 12 sp24.2.1-27.6.1fixed
Suseshadowlinux enterprise server 12 sp34.2.1-27.6.1fixed
Suseshadowlinux enterprise server for sap applications 12 sp34.2.1-27.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianshadowsourcesid1:4.7-1lowNot reported[890557]
Debianshadowsourceforky1:4.7-1lowNot reported[890557]
Debianshadowsourcetrixie1:4.7-1lowNot reported[890557]
Debianshadowsourcebookworm1:4.7-1lowNot reported[890557]
Ubuntushadowdebpro1:4.2-3.1ubuntu5.5+esm1Not reportedUBUNTU-CVE-2018-7169Not reported
Ubuntushadowdeb18.041:4.5-1ubuntu2.2Not reportedUBUNTU-CVE-2018-7169Not reported
Opensuseshadowrpmtumbleweed4.9-1.1Not reportedOPENSUSE-SU-2024:11378-1Not reported
Suseshadowrpmlinux enterprise desktop 12 sp24.2.1-27.6.1Not reportedSUSE-SU-2018:0662-1Not reported
Suseshadowrpmlinux enterprise desktop 12 sp34.2.1-27.6.1Not reportedSUSE-SU-2018:0662-1Not reported
Suseshadowrpmlinux enterprise server for raspberry pi 12 sp24.2.1-27.6.1Not reportedSUSE-SU-2018:0662-1Not reported
Suseshadowrpmlinux enterprise server 12 sp24.2.1-27.6.1Not reportedSUSE-SU-2018:0662-1Not reported
Suseshadowrpmlinux enterprise server for sap applications 12 sp24.2.1-27.6.1Not reportedSUSE-SU-2018:0662-1Not reported
Suseshadowrpmlinux enterprise server 12 sp34.2.1-27.6.1Not reportedSUSE-SU-2018:0662-1Not reported
Suseshadowrpmlinux enterprise server for sap applications 12 sp34.2.1-27.6.1Not reportedSUSE-SU-2018:0662-1Not reported

[Debian bug #890557]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libsubid6]Unknown

    Source package: [shadow]

    Details (1)

    • 4.20.2-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 4.9-1.1

      Version impact unknown

      dsa · shadow · opensuse · tumbleweed

  • [libsubid-devel]Unknown

    Source package: [shadow]

    Details (1)

    • 4.20.2-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 4.9-1.1

      Version impact unknown

      dsa · shadow · opensuse · tumbleweed

  • [login_defs]Unknown

    Source package: [shadow]

    Details (1)

    • 4.20.2-2.1 · noarch · tumbleweed

      Unknown · Fixed: 4.9-1.1

      Version impact unknown

      dsa · shadow · opensuse · tumbleweed

  • [shadow-pw-mgmt]Unknown

    Source package: [shadow]

    Details (1)

    • 4.20.2-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 4.9-1.1

      Version impact unknown

      dsa · shadow · opensuse · tumbleweed

  • [shadow]Fixed

    Source package: [shadow]

    Details (1)

    • 4.20.2-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 4.9-1.1

      dsa · shadow · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [libsubid4]Fixed

    Source package: [shadow]

    Details (2)

    • 1:4.13+dfsg1-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · bookworm; dsa · shadow · debian · 12

    • 1:4.13+dfsg1-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · bookworm; dsa · shadow · debian · 12

  • [libsubid-dev]Fixed

    Source package: [shadow]

    Details (2)

    • 1:4.13+dfsg1-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · bookworm; dsa · shadow · debian · 12

    • 1:4.13+dfsg1-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · bookworm; dsa · shadow · debian · 12

  • [login]Fixed

    Source package: [shadow]

    Details (2)

    • 1:4.13+dfsg1-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · bookworm; dsa · shadow · debian · 12

    • 1:4.13+dfsg1-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · bookworm; dsa · shadow · debian · 12

  • [passwd]Fixed

    Source package: [shadow]

    Details (2)

    • 1:4.13+dfsg1-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · bookworm; dsa · shadow · debian · 12

    • 1:4.13+dfsg1-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · bookworm; dsa · shadow · debian · 12

  • [uidmap]Fixed

    Source package: [shadow]

    Details (2)

    • 1:4.13+dfsg1-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · bookworm; dsa · shadow · debian · 12

    • 1:4.13+dfsg1-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · bookworm; dsa · shadow · debian · 12

[Debian 13 (Trixie)]

  • [libsubid5]Fixed

    Source package: [shadow]

    Details (2)

    • 1:4.17.4-2 · amd64 · trixie

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · 13

    • 1:4.17.4-2 · arm64 · trixie

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · 13

  • [libsubid-dev]Fixed

    Source package: [shadow]

    Details (2)

    • 1:4.17.4-2 · amd64 · trixie

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · 13

    • 1:4.17.4-2 · arm64 · trixie

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · 13

  • [login.defs]Fixed

    Source package: [shadow]

    Details (2)

    • 1:4.17.4-2 · all · trixie

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · 13

    • 1:4.17.4-2 · all · trixie

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · 13

  • [passwd]Fixed

    Source package: [shadow]

    Details (2)

    • 1:4.17.4-2 · amd64 · trixie

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · 13

    • 1:4.17.4-2 · arm64 · trixie

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · 13

  • [uidmap]Fixed

    Source package: [shadow]

    Details (2)

    • 1:4.17.4-2 · amd64 · trixie

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · 13

    • 1:4.17.4-2 · arm64 · trixie

      Fixed · Fixed: 1:4.7-1

      dsa · shadow · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]