CVE catalog
CVE-2024-56433
shadow: CVE-2024-56433
- Severity
- Low · CVSS 3.6
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.43% · Oct 25, 2026
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | shadow | sid | 1:4.20.3-1 | vulnerable |
| Debian | shadow | forky | 1:4.20.3-1 | vulnerable |
| Debian | shadow | trixie | 1:4.17.4-2 | vulnerable |
| Debian | shadow | bookworm | 1:4.13+dfsg1-1+deb12u2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | shadow | source | sid | (unfixed) | not yet assigned | Not reported | [1103832] |
| Debian | shadow | source | forky | (unfixed) | not yet assigned | Not reported | [1103832] |
| Debian | shadow | source | trixie | (unfixed) | not yet assigned | Not reported | [1103832] |
| Debian | shadow | source | bookworm | (unfixed) | not yet assigned | Not reported | [1103832] |
Notes
[trixie] shadow: Minor issue [bookworm] shadow: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-398330.json]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2025_20145.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2024-56433]
- [https://osv.dev/vulnerability/CVE-2024-56433]
- [https://security-tracker.debian.org/tracker/CVE-2024-56433]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56433.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3754.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]