{"id":"CVE-2019-3842","aliases":["DEBIAN-CVE-2019-3842","DLA-1762-1","DSA-4428-1","EUVD-2019-13462","GHSA-c23j-qp89-q76c","RHSA-2021:1611","RHSA-2021:3900","RLSA-2021:1611","SUSE-SU-2019:1265-1","SUSE-SU-2019:1364-1","SUSE-SU-2019:1364-2","UBUNTU-CVE-2019-3842","USN-3938-1","openSUSE-SU-2024:11420-1"],"status":"published","title":"In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the...","description":"In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".","severity":{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01207,"percentile":0.68577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-285","CWE-863"],"published":"2019-04-08T00:00:00Z","modified":"2026-10-24T10:30:54Z","exploits":[{"source":"exploitdb","id":"EDB-46743","title":"systemd - Lack of Seat Verification in PAM Module Permits Spoofing Active Session to polkit","type":"dos","platform":"linux","date":"2019-04-23","verified":true,"url":"https://www.exploit-db.com/exploits/46743"}],"fixes":[{"ecosystem":"Debian:12","package":"systemd","fixed_in":["241-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"systemd","fixed_in":["241-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"systemd","fixed_in":["241-3"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"systemd","fixed_in":["232-25+deb9u11"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"systemd","fixed_in":["204-5ubuntu20.31"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"systemd","fixed_in":["229-4ubuntu21.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"systemd","fixed_in":["237-3ubuntu10.19"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-3"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"215-17+deb8u12"}]}],"versions":["215-17","215-17+deb8u1","215-17+deb8u10","215-17+deb8u11","215-17+deb8u2","215-17+deb8u3","215-17+deb8u4","215-17+deb8u5","215-17+deb8u6","215-17+deb8u7","215-17+deb8u8","215-17+deb8u9"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"232-25+deb9u11"}]}],"versions":["232-25","232-25+deb9u1","232-25+deb9u10","232-25+deb9u2","232-25+deb9u3","232-25+deb9u4","232-25+deb9u5","232-25+deb9u6","232-25+deb9u7","232-25+deb9u8","232-25+deb9u9"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-container-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-journal-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-journal-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-udev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-udev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-container-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-journal-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-journal-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-udev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-udev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.66.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"234-24.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"234-24.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"204-5ubuntu20.31"}]}],"versions":["204-0ubuntu18","204-0ubuntu19","204-5ubuntu3","204-5ubuntu5","204-5ubuntu6","204-5ubuntu7","204-5ubuntu8","204-5ubuntu9","204-5ubuntu10","204-5ubuntu11","204-5ubuntu13","204-5ubuntu14","204-5ubuntu15","204-5ubuntu16","204-5ubuntu17","204-5ubuntu18","204-5ubuntu19","204-5ubuntu20","204-5ubuntu20.2","204-5ubuntu20.3","204-5ubuntu20.4","204-5ubuntu20.5","204-5ubuntu20.6","204-5ubuntu20.7","204-5ubuntu20.8","204-5ubuntu20.9","204-5ubuntu20.10","204-5ubuntu20.11","204-5ubuntu20.12","204-5ubuntu20.13","204-5ubuntu20.14","204-5ubuntu20.15","204-5ubuntu20.18","204-5ubuntu20.19","204-5ubuntu20.20","204-5ubuntu20.21","204-5ubuntu20.22","204-5ubuntu20.24","204-5ubuntu20.25","204-5ubuntu20.26","204-5ubuntu20.28","204-5ubuntu20.29"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"229-4ubuntu21.21"}]}],"versions":["225-1ubuntu9","227-2ubuntu1","227-2ubuntu2","228-1ubuntu2","228-2ubuntu1","228-2ubuntu2","228-3ubuntu1","228-4ubuntu1","228-4ubuntu2","228-5ubuntu1","228-5ubuntu2","228-5ubuntu3","228-6ubuntu1","229-1ubuntu2","229-1ubuntu4","229-2ubuntu1","229-3ubuntu1","229-3ubuntu2","229-4ubuntu1","229-4ubuntu4","229-4ubuntu5","229-4ubuntu6","229-4ubuntu7","229-4ubuntu8","229-4ubuntu10","229-4ubuntu11","229-4ubuntu12","229-4ubuntu13","229-4ubuntu16","229-4ubuntu17","229-4ubuntu19","229-4ubuntu20","229-4ubuntu21","229-4ubuntu21.1","229-4ubuntu21.2","229-4ubuntu21.3","229-4ubuntu21.4","229-4ubuntu21.5","229-4ubuntu21.6","229-4ubuntu21.8","229-4ubuntu21.9","229-4ubuntu21.10","229-4ubuntu21.15","229-4ubuntu21.16","229-4ubuntu21.17","229-4ubuntu21.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"237-3ubuntu10.19"}]}],"versions":["234-2ubuntu12","235-2ubuntu3","235-3ubuntu2","235-3ubuntu3","237-3ubuntu3","237-3ubuntu4","237-3ubuntu6","237-3ubuntu7","237-3ubuntu8","237-3ubuntu10","237-3ubuntu10.2","237-3ubuntu10.3","237-3ubuntu10.4","237-3ubuntu10.6","237-3ubuntu10.9","237-3ubuntu10.11","237-3ubuntu10.12","237-3ubuntu10.13","237-3ubuntu10.15","237-3ubuntu10.17"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"204-5ubuntu20.31"}]}],"versions":["204-0ubuntu18","204-0ubuntu19","204-5ubuntu3","204-5ubuntu5","204-5ubuntu6","204-5ubuntu7","204-5ubuntu8","204-5ubuntu9","204-5ubuntu10","204-5ubuntu11","204-5ubuntu13","204-5ubuntu14","204-5ubuntu15","204-5ubuntu16","204-5ubuntu17","204-5ubuntu18","204-5ubuntu19","204-5ubuntu20","204-5ubuntu20.2","204-5ubuntu20.3","204-5ubuntu20.4","204-5ubuntu20.5","204-5ubuntu20.6","204-5ubuntu20.7","204-5ubuntu20.8","204-5ubuntu20.9","204-5ubuntu20.10","204-5ubuntu20.11","204-5ubuntu20.12","204-5ubuntu20.13","204-5ubuntu20.14","204-5ubuntu20.15","204-5ubuntu20.18","204-5ubuntu20.19","204-5ubuntu20.20","204-5ubuntu20.21","204-5ubuntu20.22","204-5ubuntu20.24","204-5ubuntu20.25","204-5ubuntu20.26","204-5ubuntu20.28","204-5ubuntu20.29"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"229-4ubuntu21.21"}]}],"versions":["225-1ubuntu9","227-2ubuntu1","227-2ubuntu2","228-1ubuntu2","228-2ubuntu1","228-2ubuntu2","228-3ubuntu1","228-4ubuntu1","228-4ubuntu2","228-5ubuntu1","228-5ubuntu2","228-5ubuntu3","228-6ubuntu1","229-1ubuntu2","229-1ubuntu4","229-2ubuntu1","229-3ubuntu1","229-3ubuntu2","229-4ubuntu1","229-4ubuntu4","229-4ubuntu5","229-4ubuntu6","229-4ubuntu7","229-4ubuntu8","229-4ubuntu10","229-4ubuntu11","229-4ubuntu12","229-4ubuntu13","229-4ubuntu16","229-4ubuntu17","229-4ubuntu19","229-4ubuntu20","229-4ubuntu21","229-4ubuntu21.1","229-4ubuntu21.2","229-4ubuntu21.3","229-4ubuntu21.4","229-4ubuntu21.5","229-4ubuntu21.6","229-4ubuntu21.8","229-4ubuntu21.9","229-4ubuntu21.10","229-4ubuntu21.15","229-4ubuntu21.16","229-4ubuntu21.17","229-4ubuntu21.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"237-3ubuntu10.19"}]}],"versions":["234-2ubuntu12","235-2ubuntu3","235-3ubuntu2","235-3ubuntu3","237-3ubuntu3","237-3ubuntu4","237-3ubuntu6","237-3ubuntu7","237-3ubuntu8","237-3ubuntu10","237-3ubuntu10.2","237-3ubuntu10.3","237-3ubuntu10.4","237-3ubuntu10.6","237-3ubuntu10.9","237-3ubuntu10.11","237-3ubuntu10.12","237-3ubuntu10.13","237-3ubuntu10.15","237-3ubuntu10.17"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"249.4-2.2"}]}],"bundled":19}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"systemd","product":"systemd"},{"vendor":"systemd_project","product":"systemd"},{"vendor":"the systemd project","product":"systemd"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/46743/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3842","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/"},{"url":"https://github.com/advisories/GHSA-c23j-qp89-q76c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3842","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1611","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1740657","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1755287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1764282","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1812972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819868","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1862714","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1865840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868831","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1870638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1871139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1880270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1885553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1887181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1888912","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1889996","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1611.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3842","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3842","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13776","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13776","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3900","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3900.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1611","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191265-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1080919","tags":["report"]},{"url":"https://bugzilla.suse.com/1121563","tags":["report"]},{"url":"https://bugzilla.suse.com/1125352","tags":["report"]},{"url":"https://bugzilla.suse.com/1126056","tags":["report"]},{"url":"https://bugzilla.suse.com/1127557","tags":["report"]},{"url":"https://bugzilla.suse.com/1128657","tags":["report"]},{"url":"https://bugzilla.suse.com/1130230","tags":["report"]},{"url":"https://bugzilla.suse.com/1132348","tags":["report"]},{"url":"https://bugzilla.suse.com/1132400","tags":["report"]},{"url":"https://bugzilla.suse.com/1132721","tags":["report"]},{"url":"https://bugzilla.suse.com/955942","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6454","tags":["web"]},{"url":"https://bugzilla.suse.com/SLE-5933","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191364-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036463","tags":["report"]},{"url":"https://bugzilla.suse.com/1124122","tags":["report"]},{"url":"https://bugzilla.suse.com/1125604","tags":["report"]},{"url":"https://bugzilla.suse.com/1133506","tags":["report"]},{"url":"https://bugzilla.suse.com/1133509","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3844","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191364-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3842","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3938-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33910","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3842","description":"In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".","status":"published","published":"2019-04-09T20:25:01Z","modified":"2025-06-09T15:47:28.243Z","cvss":[{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13462","description":"In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".","status":"published","published":"2019-04-09T20:25:01Z","modified":"2025-06-09T15:47:28Z","cvss":[{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:27.753525Z"}],"ghsa":[{"id":"GHSA-c23j-qp89-q76c","title":"In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the...","description":"In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".","status":"published","published":"2022-05-13T01:04:09Z","modified":"2023-02-01T05:02:43Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:49:57.916243Z"}],"nvd":[{"id":"CVE-2019-3842","description":"In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".","status":"published","published":"2019-04-09T21:29:03.443Z","modified":"2026-06-17T02:35:42.357Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"CVE-2019-3842","description":"In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".","status":"published","published":"2019-04-09T21:29:03.443Z","modified":"2026-10-24T10:30:54.622627232Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3842","description":"In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".","status":"published","published":"2019-04-09T21:29:03.443Z","modified":"2026-09-21T07:03:18.797795609Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2021:1611","title":"Red Hat Security Advisory: systemd security, bug fix, and enhancement update","status":"published","published":"2024-09-16T04:59:34Z","modified":"2025-11-22T12:20:04Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:3900","title":"Red Hat Security Advisory: systemd security update","status":"published","published":"2024-09-16T04:59:41Z","modified":"2025-11-22T12:25:32Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:1611","title":"Moderate: systemd security, bug fix, and enhancement update","description":"The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.\n\nSecurity Fix(es):\n\n* systemd: Spoofing of XDG_SEAT allows for actions to be checked against \"allow_active\" instead of \"allow_any\" (CVE-2019-3842)\n\n* systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits (CVE-2020-13776)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T05:39:12Z","modified":"2026-02-04T21:15:07.506126Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-3842","description":"In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".","status":"published","published":"2019-04-08T00:00:00Z","modified":"2026-04-22T11:57:22.35297Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-1762-1","title":"systemd - security update","status":"published","published":"2019-04-24T00:00:00Z","modified":"2026-03-09T01:20:54.480901Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4428-1","title":"systemd - security update","status":"published","published":"2019-04-08T00:00:00Z","modified":"2026-03-09T02:08:42.771306Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2024:11420-1","title":"libsystemd0-249.4-2.2 on GA media","description":"These are all security issues fixed in the libsystemd0-249.4-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:22.858405Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:1265-1","title":"Security update for systemd","description":"This update for systemd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-6954: Fixed a vulnerability in the symlink handling of systemd-tmpfiles \n  which allowed a local user to obtain ownership of arbitrary files (bsc#1080919).\n- CVE-2019-3842: Fixed a vulnerability in pam_systemd which allowed a local user to escalate privileges (bsc#1132348).\n- CVE-2019-6454: Fixed a denial of service caused by long dbus messages (bsc#1125352).\n\nNon-security issues fixed:\n\n- systemd-coredump: generate a stack trace of all core dumps (jsc#SLE-5933)\n- udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)\n- sd-bus: bump message queue size again (bsc#1132721)\n- core: only watch processes when it's really necessary (bsc#955942 bsc#1128657)\n- rules: load drivers only on 'add' events (bsc#1126056)\n- sysctl: Don't pass null directive argument to '%s' (bsc#1121563)\n- Do not automatically online memory on s390x (bsc#1127557)\n","status":"published","published":"2019-05-16T07:53:09Z","modified":"2026-02-04T02:52:27.346819Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1364-1","title":"Security update for systemd","description":"This update for systemd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).\n- CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).\n- CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).\n\nNon-security issued fixed:\n\n- logind: fix killing of scopes (bsc#1125604)\n- namespace: make MountFlags=shared work again (bsc#1124122)\n- rules: load drivers only on 'add' events (bsc#1126056)\n- sysctl: Don't pass null directive argument to '%s' (bsc#1121563)\n- systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)\n- udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)\n- sd-bus: bump message queue size again (bsc#1132721)\n- Do not automatically online memory on s390x (bsc#1127557)\n- Removed sg.conf (bsc#1036463)\n","status":"published","published":"2019-05-28T08:51:42Z","modified":"2026-02-04T03:30:08.586125Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1364-2","title":"Security update for systemd","description":"This update for systemd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).\n- CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).\n- CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).\n\nNon-security issued fixed:\n\n- logind: fix killing of scopes (bsc#1125604)\n- namespace: make MountFlags=shared work again (bsc#1124122)\n- rules: load drivers only on 'add' events (bsc#1126056)\n- sysctl: Don't pass null directive argument to '%s' (bsc#1121563)\n- systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)\n- udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)\n- sd-bus: bump message queue size again (bsc#1132721)\n- Do not automatically online memory on s390x (bsc#1127557)\n- Removed sg.conf (bsc#1036463)\n","status":"published","published":"2019-07-15T13:48:30Z","modified":"2026-02-04T02:24:46.209032Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3938-1","title":"systemd vulnerability","description":"Jann Horn discovered that pam_systemd created logind sessions using some\nparameters from the environment. A local attacker could exploit this in\norder to spoof the active session and gain additional PolicyKit\nprivileges.\n","status":"published","published":"2019-04-08T19:26:16Z","modified":"2026-04-22T09:55:41.699715Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}