{"id":"UBUNTU-CVE-2025-29906","details":"Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration directive that can bypass `/bin/login`, i.e., a user can log in as any user without authentication. This issue has been patched in version 4.11.","modified":"2026-05-20T16:21:02.015889412Z","published":"2025-04-29T23:16:00Z","upstream":["CVE-2025-29906"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-29906"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2025-29906"},{"type":"REPORT","url":"https://github.com/troglobit/finit/commit/6528628b5c771c25ffa0cb1a46c6c89d9d0d69e0"},{"type":"REPORT","url":"https://github.com/troglobit/finit/security/advisories/GHSA-563g-p98j-mc9q"}],"affected":[{"package":{"name":"finit","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/finit?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1-1","4.2-1"],"ecosystem_specific":{"binaries":[{"binary_name":"finit","binary_version":"4.2-1"},{"binary_name":"finit-plugins","binary_version":"4.2-1"},{"binary_version":"4.2-1","binary_name":"finit-sysv"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-29906.json"}},{"package":{"name":"finit","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/finit?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2-1","4.7-1","4.7-1build1","4.7-1build2"],"ecosystem_specific":{"binaries":[{"binary_name":"finit","binary_version":"4.7-1build2"},{"binary_version":"4.7-1build2","binary_name":"finit-plugins"},{"binary_name":"finit-sysv","binary_version":"4.7-1build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-29906.json"}},{"package":{"name":"finit","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/finit?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7-3","4.11-1","4.12-1"],"ecosystem_specific":{"binaries":[{"binary_name":"finit","binary_version":"4.12-1"},{"binary_name":"finit-plugins","binary_version":"4.12-1"},{"binary_name":"finit-sysv","binary_version":"4.12-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-29906.json"}},{"package":{"name":"finit","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/finit?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12-1","4.14-1"],"ecosystem_specific":{"binaries":[{"binary_name":"finit","binary_version":"4.14-1"},{"binary_version":"4.14-1","binary_name":"finit-plugins"},{"binary_version":"4.14-1","binary_name":"finit-sysv"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-29906.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}