GHSA-7683-vm2j-m4cc

GHSA-7683-vm2j-m4cc PUBLISHED CVSS 3.5999999046325684 LOW

Record from GitHub Advisory Database · Published December 26, 2024

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Risk scores

CVSS 3.1

3.5999999046325684

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

Vendor	Product	Versions
chainguard	shadow	*
wolfi	shadow	*

Timeline

Dec 26, 2024 CVE Published
Apr 10, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-7683-vm2j-m4cc
vulnetix vdb fixes GHSA-7683-vm2j-m4cc

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-7683-vm2j-m4cc/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →