CVE-2019-3467: High severity Debian debian-lan-config vulnerability
Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-3467?
CVE-2019-3467 has critical severity due to the potential for unauthorized password changes in Kerberos user principals.
How do I fix CVE-2019-3467?
To mitigate CVE-2019-3467, update debian-edu-config to version 2.11.56+deb11u4 or higher and debian-lan-config to version 0.28.
Which versions of debian-edu-config are affected by CVE-2019-3467?
All versions of debian-edu-config prior to 2.11.10 are affected by CVE-2019-3467.
Which versions of debian-lan-config are vulnerable to CVE-2019-3467?
Any version of debian-lan-config before 0.26 is vulnerable to CVE-2019-3467.
What changes were made to resolve CVE-2019-3467?
The resolution for CVE-2019-3467 involved tightening the Access Control Lists (ACLs) for the Kerberos admin server to prevent unauthorized password changes.