Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2019-3842

Published: 8 April 2019

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".

Priority

Medium

Cvss 3 Severity Score

7.0

Score breakdown

Status

Package Release Status
systemd
Launchpad, Ubuntu, Debian
upstream
Released (241-3)
trusty
Released (204-5ubuntu20.31)
xenial
Released (229-4ubuntu21.21)
bionic
Released (237-3ubuntu10.19)
cosmic
Released (239-7ubuntu10.12)
Patches:
upstream: https://github.com/systemd/systemd/commit/83d4ab55336ff8a0643c6aa627b31e351a24040a

Severity score breakdown

Parameter Value
Base score 7.0
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H