Debian Package Tracker

general

source: shadow (main)
version: 1:4.5-1.1
maintainer: Shadow package maintainers (archive) [DMD]
uploaders: Christian Perrier [DMD] – Balint Reczey [DMD] – Serge Hallyn [DMD]
arch: any
std-ver: 3.9.5
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:4.1.5.1-1
o-o-sec: 1:4.1.5.1-1+deb7u1
oldstable: 1:4.2-3+deb8u4
old-sec: 1:4.2-3+deb8u4
stable: 1:4.4-4.1
testing: 1:4.5-1.1
unstable: 1:4.5-1.1

versioned links

1:4.1.5.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:4.1.5.1-1+deb7u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:4.2-3+deb8u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:4.4-4.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:4.5-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

login
passwd
uidmap

action needed

A new upstream version is available: 4.6 high

A new upstream version 4.6 is available, you should consider packaging it.

Created: 2018-08-20 Last update: 2018-08-20 01:53

1 security issue in buster high

There is 1 open security issue in buster.

1 important issue:

CVE-2018-7169: An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

Please fix it.

Created: 2018-02-16 Last update: 2018-08-02 14:09

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2018-7169: An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

Please fix it.

Created: 2018-02-16 Last update: 2018-08-02 14:09

lintian reports 2 errors and 10 warnings high

Lintian reports 2 errors and 10 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2015-02-28 Last update: 2018-07-28 07:57

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.1.5 instead of 3.9.5).

Created: 2014-11-21 Last update: 2018-07-27 19:49

Error while accessing the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

fatal: repository 'https://anonscm.debian.org/git/pkg-shadow/shadow.git/' not found

Created: 2017-12-03 Last update: 2018-07-03 15:58

Depends on packages which need a new maintainer normal

The packages that shadow depends on which need a new maintainer are:

docbook-xsl (#802370)
- Build-Depends: docbook-xsl
docbook-xml (#802368)
- Build-Depends: docbook-xml

Created: 2017-12-02 Last update: 2018-08-20 02:02

1 bug tagged help in the BTS normal

The BTS contains 1 bug tagged help, please consider helping the maintainer in dealing with it.

Created: 2017-08-29 Last update: 2018-08-20 01:29

10 bugs tagged patch in the BTS normal

The BTS contains patches fixing 10 bugs, consider including or untagging them.

Created: 2017-11-21 Last update: 2018-08-20 01:29

The URL(s) for this package had some recent persistent issues low

DUCK reports some issues concerning upstream URLs defined for this package.

Created: 2018-06-14 Last update: 2018-08-20 02:01

2 ignored security issues in jessie low

There are 2 open security issues in jessie.

2 issues skipped by the security teams:

CVE-2017-12424: In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.
CVE-2018-7169: An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

Please fix them.

Created: 2017-08-05 Last update: 2018-08-02 14:09

2 ignored security issues in stretch low

There are 2 open security issues in stretch.

2 issues skipped by the security teams:

CVE-2017-12424: In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.
CVE-2018-7169: An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

Please fix them.

Created: 2017-08-05 Last update: 2018-08-02 14:09

news

[rss feed]

[2018-08-03] shadow 1:4.5-1.1 MIGRATED to testing (Debian testing watch)
[2018-07-27] Accepted shadow 1:4.5-1.1 (source amd64) into unstable (Andreas Henriksson)
[2017-10-03] shadow 1:4.5-1 MIGRATED to testing (Debian testing watch)
[2017-09-27] Accepted shadow 1:4.5-1 (source) into unstable (Balint Reczey)
[2017-05-31] Accepted shadow 1:4.2-3+deb8u4 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)
[2017-05-24] shadow 1:4.4-4.1 MIGRATED to testing (Debian testing watch)
[2017-05-22] Accepted shadow 1:4.4-4.1 (source) into unstable (Salvatore Bonaccorso)
[2017-04-30] Accepted shadow 1:4.2-3+deb8u3 (source) into proposed-updates->stable-new, proposed-updates (Balint Reczey) (signed by: Salvatore Bonaccorso)
[2017-04-30] Accepted shadow 1:4.2-3+deb8u2 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)
[2017-02-26] Accepted shadow 1:4.1.5.1-1+deb7u1 (source amd64) into oldstable (Balint Reczey)
[2017-02-26] shadow 1:4.4-4 MIGRATED to testing (Debian testing watch)
[2017-02-24] Accepted shadow 1:4.4-4 (source) into unstable (Balint Reczey)
[2017-02-05] shadow 1:4.4-3 MIGRATED to testing (Debian testing watch)
[2017-01-25] Accepted shadow 1:4.4-3 (source) into unstable (Balint Reczey)
[2017-01-19] Accepted shadow 1:4.4-2 (source) into unstable (Balint Reczey)
[2017-01-17] shadow 1:4.4-1 MIGRATED to testing (Debian testing watch)
[2017-01-06] Accepted shadow 1:4.4-1 (source) into unstable (Balint Reczey)
[2016-12-03] shadow 1:4.2-3.3 MIGRATED to testing (Debian testing watch)
[2016-11-27] Accepted shadow 1:4.2-3.3 (source amd64) into unstable (Samuel Thibault)
[2016-09-25] shadow 1:4.2-3.2 MIGRATED to testing (Debian testing watch)
[2016-09-19] Accepted shadow 1:4.2-3.2 (source) into unstable (Mattia Rizzolo)
[2015-11-19] Accepted shadow 1:4.2-3+deb8u1 (source amd64) into proposed-updates->stable-new, proposed-updates (Bastian Blank)
[2015-11-18] shadow 1:4.2-3.1 MIGRATED to testing (Britney)
[2015-11-12] Accepted shadow 1:4.2-3.1 (source) into unstable (Bastian Blank)
[2014-12-01] shadow 1:4.2-3 MIGRATED to testing (Britney)
[2014-11-20] Accepted shadow 1:4.2-3 (source i386) into unstable (Christian Perrier)
[2014-05-15] shadow 1:4.2-2 MIGRATED to testing (Debian testing watch)
[2014-05-04] Accepted shadow 1:4.2-2 (source i386) (Christian Perrier)
[2014-04-23] Accepted shadow 1:4.2-1 (source i386) (Christian Perrier)
[2014-03-22] shadow 1:4.1.5.1-1.1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 71 72
RC: 0
I&N: 31 32
M&W: 30
F&P: 0
patch: 10
help: 1

links

homepage
lintian (2, 10)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:4.5-1ubuntu1
89 bugs (5 patches)
patches for 1:4.5-1ubuntu1