diff --git a/.shadow-utils.metadata b/.shadow-utils.metadata
new file mode 100644
index 0000000..ea309a2
--- /dev/null
+++ b/.shadow-utils.metadata
@@ -0,0 +1,2 @@
+fa2307ff6c85ab3863d9e24dba0935bbbb337f3f shadow-4.9.tar.xz
+aeefffb99e5391139d93a0cca2b69f72c1cee80f shadow-4.9.tar.xz.asc
diff --git a/shadow-4.9-gpasswd-fix-password-leak.patch b/shadow-4.9-gpasswd-fix-password-leak.patch
new file mode 100644
index 0000000..61bf8c0
--- /dev/null
+++ b/shadow-4.9-gpasswd-fix-password-leak.patch
@@ -0,0 +1,11 @@
+diff -up shadow-4.9/src/gpasswd.c.gpasswd-fix-password-leak shadow-4.9/src/gpasswd.c
+--- shadow-4.9/src/gpasswd.c.gpasswd-fix-password-leak	2023-07-12 09:38:32.062546006 +0200
++++ shadow-4.9/src/gpasswd.c	2023-07-12 09:42:33.194154548 +0200
+@@ -857,6 +857,7 @@ static void change_passwd (struct group
+ 		strzero (cp);
+ 		cp = getpass (_("Re-enter new password: "));
+ 		if (NULL == cp) {
++			memzero (pass, sizeof pass);
+ 			exit (1);
+ 		}
+ 
diff --git a/shadow-utils.spec b/shadow-utils.spec
index 4bae010..aba5b0b 100644
--- a/shadow-utils.spec
+++ b/shadow-utils.spec
@@ -1,7 +1,7 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
 Version: 4.9
-Release: 7%{?dist}
+Release: 8%{?dist}
 Epoch: 2
 License: BSD and GPLv2+
 URL: https://github.com/shadow-maint/shadow
@@ -78,6 +78,8 @@ Patch27: shadow-4.9-badname-special-characters.patch
 Patch28: shadow-4.9-useradd-check-if-subid-range-exists.patch
 # https://github.com/shadow-maint/shadow/commit/baae5b4a06c905d9f52ed1f922a0d7d0625d11cf
 Patch29: shadow-4.9-skip-over-reserved-ids.patch
+# https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904
+Patch30: shadow-4.9-gpasswd-fix-password-leak.patch
 
 ### Dependencies ###
 Requires: audit-libs >= 1.6.5
@@ -168,6 +170,7 @@ Development files for shadow-utils-subid.
 %patch27 -p1 -b .badname-special-characters
 %patch28 -p1 -b .useradd-check-if-subid-range-exists
 %patch29 -p1 -b .skip-over-reserved-ids
+%patch30 -p1 -b .gpasswd-fix-password-leak
 
 iconv -f ISO88591 -t utf-8  doc/HOWTO > doc/HOWTO.utf8
 cp -f doc/HOWTO.utf8 doc/HOWTO
@@ -338,6 +341,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.la
 %{_libdir}/libsubid.so
 
 %changelog
+* Wed Jul 12 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-8
+- gpasswd: fix password leak. Resolves: #2215948
+
 * Tue May 16 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-7
 - useradd: check if subid range exists for user. Resolves: #2179987
 - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #2179988