CVE-2019-3811: debian debian_linux
Vulnerability summary
CVE-2019-3811 is a medium (CVSS 5.2) vulnerability in debian debian_linux. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 53% of scored vulnerabilities.
Not severe (CVSS 4.1, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 3Timeline
- 15-01-2019PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.
CVSS metrics
7 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated5.2MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.2MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated4.1MediumCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
- NVDNIST4.1MediumCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.70% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-552Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.
Affected systems
Known conditions: adjacent network, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse9 products
- adcli&distro=SUSE Linux Enterprise Desktop 12 SP3< 0.8.2-1.3.1
- adcli&distro=SUSE Linux Enterprise Server 12 SP3< 0.8.2-1.3.1
- adcli&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 0.8.2-1.3.1
- sssd&distro=SUSE Linux Enterprise Desktop 12 SP3< 1.13.4-34.31.1
- sssd&distro=SUSE Linux Enterprise Module for Basesystem 15< 1.16.1-3.15.1
Opensuse3 products
- leapEOL15.0 | 42.3
- adcli&distro=openSUSE Leap 15.0< 0.8.2-lp150.4.1
- sssd&distro=openSUSE Leap 15.0< 1.16.1-lp150.2.9.1
Debian2 products
- sssd< 2.2.0-1 | < 1.11.7-3+deb8u2
- debian_linuxEOL8.0
Redhat1 product
- enterprise_linuxEOL7.0
The sssd project1 product
- sssd2.1
Ubuntu1 product
- sssdAll versions (No fix recorded) | < 1.16.1-1ubuntu1.8
7 vendors · 19 products
References
29 links
lists.debian.org/debian-lts-announce/2019/01/msg00011.htmlMailing ListX Refsource MLISTThird Party Advisory- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3811X Refsource CONFIRMIssue TrackingPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2019-03/msg00026.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00045.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 29 references
- bugzilla.suse.com/976038REPORT
- bugzilla.suse.com/977224REPORT
- lists.opensuse.org/archives/…Advisory