{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/coreos/rpm-ostree","packageName":"rpm-ostree","product":"","source":"CNA: redhat","vendor":"","versions":[{"status":"affected","version":"1.2024.4"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm-ostree","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2025.5-1.el10","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm-ostree","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2024.3-3.el9_4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm-ostree","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2023.3-2.el9_2","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm-ostree","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm-ostree","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2024-2905","cwes":["CWE-732"],"description":"A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.","epss":{"date":"2026-11-07","percentile":0.2601,"score":0.00328},"exploits":[],"kev":null,"metrics":[{"score":6.2,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794058906533,"publishedAt":1714067055985,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHBA-2025:4872"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:3401"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:3823"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2024-2905"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2271585"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2024:3401"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2024:3823"},{"source":"ADP: CVE","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/security/cve/CVE-2024-2905"},{"source":"ADP: CVE","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2271585"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6"},{"source":"ADP: CVE","tags":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXY3JLZC645RGFTFWSXPCYM2VWUGIDY5/"},{"source":"ADP: CVE","tags":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULCEMTHAQ3GRGL4G2ZQDX43A67P6UXQH/"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"If you need to apply the fix immediately, you can run the following commands, using credentials that have administrator access to an OpenShift cluster:\n\n# List current permissions for all nodes\nfor node in $( oc get nodes -oname) ; do echo $node ; oc debug $node -- bash -c \"ls -alhZ /host/etc/*shadow*\"; done\n\n# Set correct permissions\nfor node in $( oc get nodes -oname) ; do echo $node ; oc debug $node -- chmod --verbose 0000 /host/etc/shadow /host/etc/gshadow /host/etc/shadow- /host/etc/gshadow-; done\n\nAs a precaution, we recommend rotating all user credentials stored in those files."}],"revision":"f46dcaabff6581c933e33c558c8f104d4cb23584174eac18f0388052d309da2e","sources":[{"modifiedAt":1794058906533,"name":"CNA: redhat","retrievedAt":1794060525288,"url":"https://www.cve.org/CVERecord?id=CVE-2024-2905"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794064130177,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-2905"}],"ssvc":{"assessedAt":1714072245667,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Rpm-ostree: world-readable /etc/shadow file","updatedAt":1794064130177}