Description
A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | rpm-ostree | 1.2024.4 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rpm-ostree +1 | 2025.5-1.el10 | RHBA-2025:4872 |
| RHEL 9 | rpm-ostree +1 | 2024.3-3.el9_4 | RHSA-2024:3823 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | rpm-ostree +1 | 2023.3-2.el9_2 | RHSA-2024:3401 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | rpm-ostree +1 | 2024.3-3.el9_4 | ALSA-2024:3823 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | rpm-ostree | 2024.4-3 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | rpm-ostree +1 | 2024.3-3.el9_4 | ELSA-2024-3823 |
Advisories 6
- ALSA-2024:3823 Moderate: rpm-ostree security update AlmaLinux Security Advisories · Oct 29, 2026
- RHBA-2025:4872 Red Hat Bug Fix Advisory: rpm-ostree bug fix and enhancement update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:3823 Red Hat Security Advisory: rpm-ostree security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:3401 Red Hat Security Advisory: rpm-ostree security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- WID-SEC-2024-1242 Red Hat Enterprise Linux (rpm-ostree): Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 13, 2024
- ELSA-2024-3823 Moderate: rpm-ostree security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 12, 2024
References
- RHBA-2025:4872 vendor-advisory
- RHSA-2024:3401 vendor-advisory
- RHSA-2024:3823 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-2905 vdb-entry
- RHBZ#2271585 issue-tracking
- https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6