Homepage

CVE-2024-56433 The advisory has been revoked - it doesn't affect any version of package shadow-utils  (opens in a new tab)

Threat Intelligence

EPSS
0.43% (35th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX10-SHADOWUTILS-14115022
  • published26 Nov 2025
  • disclosed11 Nov 2025
Report a new vulnerability Found a mistake?

Introduced: 11 Nov 2025

CVE-2024-56433  (opens in a new tab)

Amendment

The AlmaLinux security team deemed this advisory irrelevant for AlmaLinux:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow-utils package and not the shadow-utils package as distributed by AlmaLinux.

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.