CVE-2019-19191
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files...
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.
- Record
CVE-2019-19191- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.
- Record
CVE-2019-19191- Updated
- 2026-11-02
EUVDEUVD-2019-8823 No score
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.
- Record
EUVD-2019-8823- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gcm7-32c7-5wrq
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files...
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.
- Record
GHSA-gcm7-32c7-5wrq- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.
- Record
CVE-2019-19191- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-19191
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.
- Record
DEBIAN-CVE-2019-19191- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2020:0020-1 No score
Security update for shibboleth-sp
This update for shibboleth-sp fixes the following issues:
Security issue fixed:
- CVE-2019-19191: Fixed escalation to root by fixing ownership of log files (bsc#1157471).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0020-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11381-1 No score
libshibsp-lite10-3.2.3-1.2 on GA media
These are all security issues fixed in the libshibsp-lite10-3.2.3-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11381-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:3386-1 No score
Security update for shibboleth-sp
This update for shibboleth-sp fixes the following issues:
Security issue fixed:
- CVE-2019-19191: Fixed escalation to root by fixing ownership of log files (bsc#1157471).
- Record
SUSE-SU-2019:3386-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0115-1 No score
Security update for shibboleth-sp
This update for shibboleth-sp fixes the following issues:
Security issue fixed:
- CVE-2019-19191: Fixed escalation to root by fixing ownership of log files (bsc#1157471).
- Record
SUSE-SU-2020:0115-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shibboleth-spDebian:12 |
before 3.1.0+dfsg1-2 | 3.1.0+dfsg1-2 |
shibboleth-spDebian:13 |
before 3.1.0+dfsg1-2 | 3.1.0+dfsg1-2 |
shibboleth-spDebian:14 |
before 3.1.0+dfsg1-2 | 3.1.0+dfsg1-2 |
shibboleth-spSUSE:Linux Enterprise Module for Server Applications 15 |
before 2.6.1-3.3.1 | 2.6.1-3.3.1 |
shibboleth-spSUSE:Linux Enterprise Module for Server Applications 15 SP1 |
before 2.6.1-3.3.1 | 2.6.1-3.3.1 |
shibboleth-spSUSE:HPE Helion OpenStack 8 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:OpenStack Cloud 7 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:OpenStack Cloud 8 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:OpenStack Cloud Crowbar 8 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
shibboleth-spSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server 12 SP1-LTSS |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server 12 SP2-BCL |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server 12 SP3-BCL |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server 12 SP4 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server 12 SP5 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spSUSE:Enterprise Storage 5 |
before 2.5.5-6.6.1 | 2.5.5-6.6.1 |
shibboleth-spopenSUSE:Leap 15.1 |
before 2.6.1-lp151.3.3.1 | 2.6.1-lp151.3.3.1 |
sha1collisiondetectionopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 3.2.3-1.2 | 3.2.3-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-19191 is a high vulnerability (CVSS 7.8) in Shibboleth Service Provider, published November 21, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in shibboleth-sp 3.1.0+dfsg1-2.
References
issues.shibboleth.net/jira/browse/SSPCPP-874
bugzilla.suse.com/show_bug.cgi?id=1157471
lists.opensuse.org/opensuse-security-announce/2020-01/msg00017.html
nvd.nist.gov/vuln/detail/CVE-2019-19191
github.com/advisories/GHSA-gcm7-32c7-5wrq
security-tracker.debian.org/tracker/CVE-2019-19191
Show 6 moreShow less
suse.com/support/update/announcement/2019/suse-su-20193386-1