CVEvulnerability

CVE-2019-3811

5.2 MEDIUM Published 2019-01-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-01-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.2 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
4.1 MEDIUM — CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS 2.0 ([email protected])
2.7 LOW — AV:A/AC:L/Au:S/C:N/I:N/A:P
Weaknesses
CWE-200, CWE-552

Description

A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.

Affected configurations

• fedoraproject sssd (< 2.1) • debian debian linux 8.0 • fedoraproject fedora • opensuse leap 15.0 • opensuse leap 42.3 • redhat enterprise linux 7.0

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-552 Files or Directories Accessible to External Parties weakness

References