Description
libuser before 0.57 uses a cleartext password value of (1) !! or (2) x for new LDAP user accounts, which makes it easier for remote attackers to obtain access by specifying one of these values.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libuser | 1:0.56.9.dfsg.1-1.1 | — |
| Debian 13 | libuser | 1:0.56.9.dfsg.1-1.1 | — |
| Debian 12 | libuser | 1:0.56.9.dfsg.1-1.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libuser +2 | 0.56.13-4.el6_0.1 | RHSA-2011:0170 |
| RHEL 5 | libuser +1 | 0.54.7-2.1.el5_5.2 | RHSA-2011:0170 |
| RHEL 4 | libuser +1 | 0.52.5-1.1.el4_8.1 | RHSA-2011:0170 |
Advisories 1
- RHSA-2011:0170 Red Hat Security Advisory: libuser security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2011:0170 vendor-advisory
- 43047 third-party-advisory
- 1024960 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=643227
- FEDORA-2011-0316 vendor-advisory
- 42891 third-party-advisory
- 45791 vdb-entry
- ADV-2011-0226 vdb-entry
- libuser-password-security-bypass(64677) vdb-entry
- ADV-2011-0201 vdb-entry
- 42966 third-party-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- https://fedorahosted.org/libuser/browser/NEWS?rev=libuser-0.57
- ADV-2011-0184 vdb-entry
- 70421 vdb-entry
- MDVSA-2011:019 vendor-advisory
- FEDORA-2011-0320 vendor-advisory