Skip to content
Fencer Vulns
medium 4.8

CVE-2018-1113 json

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells.

published 2018-07-02 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-11758

cvss
4.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.

Patch / fix

  • redhat setup 2.11.4
  • setup RHEL 7 2.8.71-10.el7

red hat advisories RHSA-2018:3249

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1113 updated cvss 4.8

setup: nologin listed in /etc/shells violates security expectations

  • Red Hat Enterprise Linux 5 setup
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 setup
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux Client (v. 7) setup 2.8.71-10.el7 Red Hat Enterprise Linux ComputeNode (v. 7) setup 2.8.71-10.el7 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) setup 2.8.71-10.el7 Red Hat Enterprise Linux Server (v. 7) setup 2.8.71-10.el7 Red Hat Enterprise Linux Workstation (v. 7) setup 2.8.71-10.el7
    fixed: vendor fix RHSA-2018:3249
  • Red Hat Enterprise Linux 8 setup
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
NVD 3.0 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • [UNKNOWN] setup

Classification

Weakness
  • CWE-285 Improper Authorization
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.