Incorrect permission assignment in Debian Edu
Priority LOW 35CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.
Why it matters now
EPSS 0.00503 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Debian Edu (Debian): 2.11.10
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Debian | Debian Edu | before 2.11.10 | 2.11.10 | Patch available | CNA |
- Debian Edu VendorDebian Affected before 2.11.10 Fixed in 2.11.10 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:debian:debian-lan-config:*:*:*:*:*:*:*:* | before 0.26 | Vulnerable | Debian |
| cpe:2.3:a:skolelinux:debian-edu-config:*:*:*:*:*:*:*:* | before 2.11.10 | Vulnerable | Skolelinux |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
- cpe:2.3:a:debian:debian-lan-config:*:*:*:*:*:*:*:* Versions before 0.26 Vulnerable ·Debian
- cpe:2.3:a:skolelinux:debian-edu-config:*:*:*:*:*:*:*:* Versions before 2.11.10 Vulnerable ·Skolelinux
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
Remediation
- Fix · CNA Debian Edu (Debian) Fixed in 2.11.10
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3467
- 2026-10-03 Alias added: GHSA-qwf4-gh23-f5jj
References
Advisory 9
- [debian-lts-announce] 20191218 [SECURITY] [DLA 2041-1] debian-edu-config security update
- 20191218 [SECURITY] [DSA 4589-1] debian-edu-config security update
- DSA-4589
- https://security-tracker.debian.org/tracker/CVE-2019-3467
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947459
- DSA-4595
- 20191229 [SECURITY] [DSA 4595-1] debian-lan-config security update
- [debian-lts-announce] 20200115 [SECURITY] [DLA 2063-1] debian-lan-config security update
- USN-4530-1
Sources
- CVE-2019-3467 · CVE Program
- CVE-2019-3467 · NVD
- FIRST EPSS
- GHSA-qwf4-gh23-f5jj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences