This seems to be an oversight from Redhat since this very bug was fixed in shadow-utils 4.0.3-42 (released later as -55 & -56 for fc2/3). Advisory id's are: FEDORA-2004-510 (FC3) & FEDORA-2004-509 (FC2)
Here's the changelog snippet.
* Tue Nov 16 2004 Adrian Havill <havill redhat com> 2:4.0.3-42
- change MAXMEM static limit on group count to dynamic (#125510) - re-allow "$" as last char for the sake of samba (#132782) - don't strip binaries for debuginfo
sadly I'm not allowed to view bug 132782. Can you reopen it or should I file a new one?