CVE-2019-3811

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-3811
A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.

5.2 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

2.7 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:A/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 5.1 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00026.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00045.html Mailing List Third Party Advisory
http://www.securityfocus.com/bid/106644 Broken Link
https://access.redhat.com/errata/RHSA-2019:2177 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3811 Issue Tracking Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00011.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html
Configurations

Configuration 1 (hide)

cpe:2.3:a:fedoraproject:sssd:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
History

29 May 2023, 17:15

Type Values Removed Values Added
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html -
CWE CWE-552
CWE-200		 NVD-CWE-Other

12 Feb 2023, 23:38

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2019-3811', 'name': 'https://access.redhat.com/security/cve/CVE-2019-3811', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1656618', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1656618', 'tags': [], 'refsource': 'MISC'}
Summary A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot(). A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.
CWE NVD-CWE-Other CWE-552
CWE-200

02 Feb 2023, 16:19

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2019-3811 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1656618 -
Summary A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable. A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot().

02 Nov 2021, 20:07

Type Values Removed Values Added
CWE CWE-20 NVD-CWE-Other
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00026.html - Third Party Advisory (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00026.html - Mailing List, Third Party Advisory
References (BID) http://www.securityfocus.com/bid/106644 - Third Party Advisory, VDB Entry (BID) http://www.securityfocus.com/bid/106644 - Broken Link
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2177 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:2177 - Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00045.html - Third Party Advisory (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00045.html - Mailing List, Third Party Advisory
Information

Published : 2019-01-15 15:29

Updated : 2023-12-10 12:44

NVD link : CVE-2019-3811

Mitre link : CVE-2019-3811

CVE.ORG link : CVE-2019-3811

JSON object : View

Products Affected

debian

  • debian_linux

redhat

  • enterprise_linux

fedoraproject

  • fedora
  • sssd

opensuse

  • leap
CWE
NVD-CWE-Other CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-552

Files or Directories Accessible to External Parties