Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2025-29906

Finit bundled getty can bypass /bin/login

Description

Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration directive that can bypass `/bin/login`, i.e., a user can log in as any user without authentication. This issue has been patched in version 4.11.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

troglobit finit

  • >= 3.0-rc1, < 4.11affected

References