CVE-2019-3467

Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu,...

7.8 HighFix available

CVE-2019-3467 is a high vulnerability (CVSS 7.8) in Debian Edu, published December 18, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in debian-edu-config 2.11.10.

Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.50%Down 1.8 points since Apr 14, 2021

What each source reports

NVD Score used 7.8

Record: CVE-2019-3467
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-732
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-3467
Updated: 2026-11-02

EUVDEUVD-2019-13105 No score

Record: EUVD-2019-13105
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qwf4-gh23-f5jj 7.8

Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu,...

Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.

Record: GHSA-qwf4-gh23-f5jj
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-732
Updated: 2026-11-02

OSV 7.8

Record: CVE-2019-3467
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-3467 7.8

Record: DEBIAN-CVE-2019-3467
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-3467 7.8

Record: UBUNTU-CVE-2019-3467
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-4530-1 No score

debian-lan-config vulnerabilities

Wolfgang Schweer discovered that Debian-LAN did not properly handle ACLs for the Kerberos admin server. A local attacker could possibly use this issue to change the passwords of other users, leading to root privilege escalation. (CVE-2019-3467)

Record: USN-4530-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`debian-edu-config` Debian:12	before 2.11.10	2.11.10
`debian-edu-config` Debian:13	before 2.11.10	2.11.10
`debian-edu-config` Debian:8	before 1.818+deb8u3, plus listed versions 1.8181.818+deb8u11.818+deb8u2	1.818+deb8u3
`debian-lan-config` Debian:8	before 0.19+deb8u2, plus listed versions 0.190.19+deb8u1	0.19+deb8u2
`debian-edu-config` Debian:9	before 1.929+deb9u4, plus listed versions 1.9291.929+deb9u11.929+deb9u21.929+deb9u3	1.929+deb9u4
`debian-edu-config` Debian:10	before 2.10.65+deb10u3, plus listed versions 2.10.652.10.65+deb10u12.10.65+deb10u2	2.10.65+deb10u3
`debian-lan-config` Debian:9	before 0.23+deb9u1, plus listed versions 0.23	0.23+deb9u1
`debian-lan-config` Debian:10	before 0.25+deb10u1, plus listed versions 0.25	0.25+deb10u1
`debian-lan-config` Ubuntu:16.04:LTS	All versions, plus listed versions 0.21	None known
`debian-lan-config` Ubuntu:18.04:LTS	before 0.23+deb9u1build0.18.04.1, plus listed versions 0.23	0.23+deb9u1build0.18.04.1
`debian-lan-config` Ubuntu:20.04:LTS	before 0.26, plus listed versions 0.25	0.26

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 9 moreShow less