Security bugs are reported here via bugzilla

[Thomas Orgis <thomas-forum AT orgis.org>]

----- Bad bug, fix in test -----

The last shadow update brought a nasty side effect in case you say "n"
to the "fix/convert accounts" question:
PRE_REMOVE executed pwunconv/grpunconv unconditionally on dispel - and
a dispel happens on every upgrade before the new version is installed.

Thus, an upgrade to recent shadow could leave you with the password
hashes back in /etc/passwd!
Please refer to bug 8834
(http://bugs.sourcemage.org/show_bug.cgi?id=8834) for details and
history on that one.
There is a fix in git and about to be in the next test tarball.

Every admin should have a look at his /etc/passwd and /etc/group and
check if he may need a run of pwconv and grpconv!
The updated version of the spell has some logic to detect un-shadowed
passwd files and in that case defaults to running pwconv/grpconv unless
you say no.
The malicious unconv calls in PRE_REMOVE are removed now and the update
to the fixed shadow will _not_ unconv your files.
Even an explicit  dispel shadow will not convert the files back now -
if you really want to do that, execute *unconv before dispelling if you
wish.


Thomas.