---
id: CVE-2024-2905
title: 'Rpm-ostree: world-readable /etc/shadow file'
summary: >-
  A security vulnerability has been discovered within rpm-ostree, pertaining to
  the /etc/shadow file in default builds having the world-readable bit enabled.
  This issue arises from the default permissions being set at a higher level
  than r…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-732
vendor: Red Hat
product: rpm-ostree
affected:
  - rpm-ostree 1.2024.4
  - rpm-ostree (all versions)
  - rpm-ostree (all versions)
  - rpm-ostree (all versions)
  - rpm-ostree
  - rpm-ostree
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-04-25T19:10:45.667596Z'
published: '2024-04-25'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T13:41:46.533Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-2905'
references:
  - url: 'https://access.redhat.com/errata/RHBA-2025:4872'
    label: 'RHBA-2025:4872'
  - url: 'https://access.redhat.com/errata/RHSA-2024:3401'
    label: 'RHSA-2024:3401'
  - url: 'https://access.redhat.com/errata/RHSA-2024:3823'
    label: 'RHSA-2024:3823'
  - url: 'https://access.redhat.com/security/cve/CVE-2024-2905'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2271585'
    label: RHBZ#2271585
  - url: >-
      https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6
tags:
  - cve.org
epss: 0.00328
epssPercentile: 0.2601
ingestedAt: '2026-11-07T14:18:21.469Z'
---

## Overview

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.

## Affected

- `rpm-ostree 1.2024.4`
- `rpm-ostree (all versions)`
- `rpm-ostree (all versions)`
- `rpm-ostree (all versions)`
- `rpm-ostree`
- `rpm-ostree`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

If you need to apply the fix immediately, you can run the following commands, using credentials that have administrator access to an OpenShift cluster:

# List current permissions for all nodes
for node in $( oc get nodes -oname) ; do echo $node ; oc debug $node -- bash -c "ls -alhZ /host/etc/*shadow*"; done

# Set correct permissions
for node in $( oc get nodes -oname) ; do echo $node ; oc debug $node -- chmod --verbose 0000 /host/etc/shadow /host/etc/gshadow /host/etc/shadow- /host/etc/gshadow-; done

As a precaution, we recommend rotating all user credentials stored in those files.