[AUTO-CHERRYPICK] shadow-utils: patch CVE-2023-4641[Medium] - branch main (#13611)

Co-authored-by: Archana Choudhary <36061892+arc9693@users.noreply.github.com>
Co-authored-by: Aditya Dubey <110563293+Adub17030MS@users.noreply.github.com>

Author: 3 people

SPECS/shadow-utils/CVE-2023-4641.patch

@@ -0,0 +1,12 @@
+# CVE-2023-4641: gpasswd: memory leak in getpass() function
+# Backport fix from https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904
+# Signed-off-by: Archana Choudhary <archana1@microsoft.com>
+--- a/src/gpasswd.c	2021-07-22 21:50:51.000000000 +0000
++++ b/src/gpasswd.c	2025-04-14 13:34:13.478082742 +0000
+@@ -919,6 +919,7 @@
+ 		strzero (cp);
+ 		cp = getpass (_("Re-enter new password: "));
+ 		if (NULL == cp) {
++			memzero (pass, sizeof pass);
+ 			exit (1);
+ 		}

SPECS/shadow-utils/shadow-utils.spec

@@ -1,7 +1,7 @@
 Summary:        Programs for handling passwords in a secure way
 Name:           shadow-utils
 Version:        4.9
-Release:        13%{?dist}
+Release:        14%{?dist}
 License:        BSD
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -23,6 +23,7 @@ Source13:       login-defs
 Patch0:         chkname-allowcase.patch
 Patch1:         libsubid-pam-link.patch
 Patch2:         CVE-2023-29383.patch
+Patch3:         CVE-2023-4641.patch
 BuildRequires:  autoconf
 BuildRequires:  audit-devel
 BuildRequires:  automake
@@ -68,10 +69,7 @@ Requires:       %{name}-subid = %{version}-%{release}
 Libraries and headers for libsubid
 
 %prep
-%setup -q -n shadow-%{version}
-%patch0 -p1
-%patch1 -p1
-%patch2 -p1
+%autosetup -n shadow-%{version} -p1
 
 autoreconf -fiv
 
@@ -178,6 +176,9 @@ chmod 000 %{_sysconfdir}/shadow
 %{_libdir}/libsubid.so
 
 %changelog
+* Wed Jan 15 2025 Archana Choudhary <archana1@microsoft.com> - 4.9-14
+- Patch for CVE-2023-4641
+
 * Wed Sep 20 2023 Kanika Nema <kanikanema@microsoft.com> - 4.9-13
 - Recompile with stack-protection fixed gcc version (CVE-2023-4039)
 - Address CVE-2023-29383