{"schemaVersion":3,"id":"USN-5745-2","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"shadow regression\n\nUSN-5745-1 fixed vulnerabilities in shadow. Unfortunately that update\nintroduced a regression that caused useradd to behave incorrectly in Ubuntu\n14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. This\nupdate reverts the security fix pending further investigation.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Florian Weimer discovered that shadow was not properly copying and removing\n user directory trees, which could lead to a race condition. A local attacker\n could possibly use this issue to setup a symlink attack and alter or remove\n directories without authorization.","dates":{"published":"2022-11-29T17:23:51.000Z","modified":"2026-06-29T13:50:43.430Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"shadow","name":"shadow","label":"shadow","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/shadow","purlType":"deb","versions":[{"text":"< 1:4.1.5.1-1ubuntu9.5+esm3","noFixRecorded":false,"fixedIn":null},{"text":"< 1:4.2-3.1ubuntu5.5+esm3","noFixRecorded":false,"fixedIn":null},{"text":"< 1:4.5-1ubuntu2.5","noFixRecorded":false,"fixedIn":null},{"text":"< 1:4.8.1-1ubuntu5.20.04.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:4.1.5.1-1ubuntu9.5+esm3 | < 1:4.2-3.1ubuntu5.5+esm3 | < 1:4.5-1ubuntu2.5 | < 1:4.8.1-1ubuntu5.20.04.4","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-5745-2","label":"ubuntu.com/security/notices/USN-5745-2","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://launchpad.net/bugs/1998169","label":"launchpad.net/bugs/1998169","hostname":"launchpad.net","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CVE-2013-4235"]},"timeline":[{"kind":"published","date":"2022-11-29T17:23:51.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-29T13:50:43.430Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T10:08:45.221Z","stale":false,"partial":false}}