shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2025_20559 advisory.

    * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise     (CVE-2024-56433)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2025_20145 advisory.

    * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise     (CVE-2024-56433)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-2026_1389 advisory.

    This advisory aggregates security fixes for the shadow-utils SRPM in CIQ LTS 9.6. It addresses 1 CVE:
    CVE-2024-56433.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-11140:02 advisory.

    * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise     (CVE-2024-56433)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-201450 advisory.

    [2:4.15.0-8]
    - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-93172

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:20145 advisory.

    * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise     (CVE-2024-56433)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:20145 advisory.

    * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise     (CVE-2024-56433)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-205590 advisory.

    [2:4.9-15]
    - nss.c: shadow_logfd to stderr. Resolves: RHEL-83431
    - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-70844 and RHEL-72940

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:20559 advisory.

    * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise     (CVE-2024-56433)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:20559 advisory.

    * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise     (CVE-2024-56433)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:20145 advisory.

    The shadow-utils packages include programs for converting UNIX password files to the shadow password     format, as well as utilities for managing user and group accounts.

    Security Fix(es):

    * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise     (CVE-2024-56433)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:20559 advisory.

    The shadow-utils packages include programs for converting UNIX password files to the shadow password     format, as well as utilities for managing user and group accounts.

    Security Fix(es):

    * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise     (CVE-2024-56433)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000     through 165535 for the first user account) that can realistically conflict with the uids of users defined     on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap     for access to an NFS home directory (or same-host resources in the case of remote logins by these local     network users). NOTE: it may also be argued that system administrators should not have assigned uids,     within local networks, that are within the range that can occur in /etc/subuid. (CVE-2024-56433)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
358262	Rocky Linux 9 [CIQ] Security Update: shadow-utils / shadow-utils-debuginfo / shadow-utils-debugsource / etc (crlsa-2025_20559)	Nessus	Rocky Linux Local Security Checks	Local	low
358045	Rocky Linux 10.1 [CIQ] Security Update: shadow-utils / shadow-utils-debuginfo / shadow-utils-debugsource / etc (crlsa-2025_20145)	Nessus	Rocky Linux Local Security Checks	Local	low
354767	Rocky Linux 9.6 [CIQ] Security Update: shadow-utils / shadow-utils-subid / shadow-utils-subid-devel (ciqsa-2026_1389)	Nessus	Rocky Linux Local Security Checks	Local	low
282940	MiracleLinux 9 : shadow-utils-4.9-15.el9 (AXSA:2025-11140:02)	Nessus	Miracle Linux Local Security Checks	Local	low
277135	Oracle Linux 10 : ELSA-2025-20145-0: / shadow-utils (ELSA-2025-201450)	Nessus	Oracle Linux Local Security Checks	Local	low
277003	RockyLinux 10 : shadow-utils (RLSA-2025:20145)	Nessus	Rocky Linux Local Security Checks	Local	low
276759	AlmaLinux 10 : shadow-utils (ALSA-2025:20145)	Nessus	Alma Linux Local Security Checks	Local	low
276703	Oracle Linux 9 : ELSA-2025-20559-0: / shadow-utils (ELSA-2025-205590)	Nessus	Oracle Linux Local Security Checks	Local	low
276552	RockyLinux 9 : shadow-utils (RLSA-2025:20559)	Nessus	Rocky Linux Local Security Checks	Local	low
275799	AlmaLinux 9 : shadow-utils (ALSA-2025:20559)	Nessus	Alma Linux Local Security Checks	Local	low
504090	Siemens SIMATIC S7-1500 Initialization of a Resource with an Insecure Default (CVE-2024-56433)	Tenable OT Security	Tenable.ot	Remote	low
274777	RHEL 10 : shadow-utils (RHSA-2025:20145)	Nessus	Red Hat Local Security Checks	Local	low
274721	RHEL 9 : shadow-utils (RHSA-2025:20559)	Nessus	Red Hat Local Security Checks	Local	low
230845	Linux Distros Unpatched Vulnerability : CVE-2024-56433	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2024-56433

low

Tenable Plugins

low

low

low

low

low

low

low

low

low

low

low

low

low

low