CVE - CVE-2024-2905

CVE-ID
CVE-2024-2905	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:RHBZ#2271585 URL:https://bugzilla.redhat.com/show_bug.cgi?id=2271585 MISC:RHSA-2024:3401 URL:https://access.redhat.com/errata/RHSA-2024:3401 MISC:RHSA-2024:3823 URL:https://access.redhat.com/errata/RHSA-2024:3823 MISC:https://access.redhat.com/security/cve/CVE-2024-2905 URL:https://access.redhat.com/security/cve/CVE-2024-2905 MISC:https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6 URL:https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6
Assigning CNA
Red Hat, Inc.
Date Record Created
20240326	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240326)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)