{"id":"CVE-2020-13776","aliases":["DEBIAN-CVE-2020-13776","EUVD-2020-5993","GHSA-g2fm-j5p3-x5h7","MGASA-2021-0304","OESA-2022-1538","RHSA-2021:1611","RHSA-2021:3900","RLSA-2021:1611","UBUNTU-CVE-2020-13776"],"status":"published","title":"systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x...","description":"systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00461,"percentile":0.40237,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2020-06-03T02:05:22Z","modified":"2026-10-26T12:00:35Z","fixes":[{"ecosystem":"Debian:12","package":"systemd","fixed_in":["246-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"systemd","fixed_in":["246-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"systemd","fixed_in":["246-2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"systemd","fixed_in":["241-8.6.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"systemd","fixed_in":["243-50.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"systemd","fixed_in":["243-51.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"systemd","fixed_in":["243-54.oe1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"246-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"246-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"246-2"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-8.6.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"243-50.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"243-51.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"243-54.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-container-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-journal-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-journal-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-udev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-udev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-container-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-journal-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-journal-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-udev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"systemd-udev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-31.el8_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-45.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["204-0ubuntu18","204-0ubuntu19","204-5ubuntu3","204-5ubuntu5","204-5ubuntu6","204-5ubuntu7","204-5ubuntu8","204-5ubuntu9","204-5ubuntu10","204-5ubuntu11","204-5ubuntu13","204-5ubuntu14","204-5ubuntu15","204-5ubuntu16","204-5ubuntu17","204-5ubuntu18","204-5ubuntu19","204-5ubuntu20","204-5ubuntu20.2","204-5ubuntu20.3","204-5ubuntu20.4","204-5ubuntu20.5","204-5ubuntu20.6","204-5ubuntu20.7","204-5ubuntu20.8","204-5ubuntu20.9","204-5ubuntu20.10","204-5ubuntu20.11","204-5ubuntu20.12","204-5ubuntu20.13","204-5ubuntu20.14","204-5ubuntu20.15","204-5ubuntu20.18","204-5ubuntu20.19","204-5ubuntu20.20","204-5ubuntu20.21","204-5ubuntu20.22","204-5ubuntu20.24","204-5ubuntu20.25","204-5ubuntu20.26","204-5ubuntu20.28","204-5ubuntu20.29","204-5ubuntu20.31","204-5ubuntu20.31+esm2","204-5ubuntu20.31+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["225-1ubuntu9","227-2ubuntu1","227-2ubuntu2","228-1ubuntu2","228-2ubuntu1","228-2ubuntu2","228-3ubuntu1","228-4ubuntu1","228-4ubuntu2","228-5ubuntu1","228-5ubuntu2","228-5ubuntu3","228-6ubuntu1","229-1ubuntu2","229-1ubuntu4","229-2ubuntu1","229-3ubuntu1","229-3ubuntu2","229-4ubuntu1","229-4ubuntu4","229-4ubuntu5","229-4ubuntu6","229-4ubuntu7","229-4ubuntu8","229-4ubuntu10","229-4ubuntu11","229-4ubuntu12","229-4ubuntu13","229-4ubuntu16","229-4ubuntu17","229-4ubuntu19","229-4ubuntu20","229-4ubuntu21","229-4ubuntu21.1","229-4ubuntu21.2","229-4ubuntu21.3","229-4ubuntu21.4","229-4ubuntu21.5","229-4ubuntu21.6","229-4ubuntu21.8","229-4ubuntu21.9","229-4ubuntu21.10","229-4ubuntu21.15","229-4ubuntu21.16","229-4ubuntu21.17","229-4ubuntu21.19","229-4ubuntu21.21","229-4ubuntu21.22","229-4ubuntu21.23","229-4ubuntu21.27","229-4ubuntu21.28","229-4ubuntu21.29","229-4ubuntu21.31","229-4ubuntu21.31+esm1","229-4ubuntu21.31+esm3","229-4ubuntu21.31+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["234-2ubuntu12","235-2ubuntu3","235-3ubuntu2","235-3ubuntu3","237-3ubuntu3","237-3ubuntu4","237-3ubuntu6","237-3ubuntu7","237-3ubuntu8","237-3ubuntu10","237-3ubuntu10.2","237-3ubuntu10.3","237-3ubuntu10.4","237-3ubuntu10.6","237-3ubuntu10.9","237-3ubuntu10.11","237-3ubuntu10.12","237-3ubuntu10.13","237-3ubuntu10.15","237-3ubuntu10.17","237-3ubuntu10.19","237-3ubuntu10.20","237-3ubuntu10.21","237-3ubuntu10.22","237-3ubuntu10.23","237-3ubuntu10.24","237-3ubuntu10.25","237-3ubuntu10.26","237-3ubuntu10.28","237-3ubuntu10.29","237-3ubuntu10.31","237-3ubuntu10.33","237-3ubuntu10.38","237-3ubuntu10.39","237-3ubuntu10.40","237-3ubuntu10.41","237-3ubuntu10.42","237-3ubuntu10.43","237-3ubuntu10.44","237-3ubuntu10.45","237-3ubuntu10.46","237-3ubuntu10.47","237-3ubuntu10.48","237-3ubuntu10.49","237-3ubuntu10.50","237-3ubuntu10.51","237-3ubuntu10.52","237-3ubuntu10.53","237-3ubuntu10.54","237-3ubuntu10.56","237-3ubuntu10.57","237-3ubuntu10.57+esm2","237-3ubuntu10.57+esm3","237-3ubuntu10.57+esm4","237-3ubuntu10.57+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["242-7ubuntu3","243-2ubuntu1","243-3ubuntu1","244-3ubuntu1","244.1-0ubuntu2","244.1-0ubuntu3","244.2-1ubuntu1","244.3-1ubuntu1","245.2-1ubuntu1","245.2-1ubuntu2","245.4-2ubuntu1","245.4-4ubuntu1","245.4-4ubuntu3","245.4-4ubuntu3.1","245.4-4ubuntu3.2","245.4-4ubuntu3.3","245.4-4ubuntu3.4","245.4-4ubuntu3.5","245.4-4ubuntu3.6","245.4-4ubuntu3.7","245.4-4ubuntu3.10","245.4-4ubuntu3.11","245.4-4ubuntu3.13","245.4-4ubuntu3.14","245.4-4ubuntu3.15","245.4-4ubuntu3.16","245.4-4ubuntu3.17","245.4-4ubuntu3.18","245.4-4ubuntu3.19","245.4-4ubuntu3.20","245.4-4ubuntu3.21","245.4-4ubuntu3.22","245.4-4ubuntu3.23","245.4-4ubuntu3.24","245.4-4ubuntu3.24+esm1","245.4-4ubuntu3.24+esm3","245.4-4ubuntu3.24+esm4","245.4-4ubuntu3.24+esm5","245.4-4ubuntu3.24+esm6"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"systemd_project","product":"systemd"}],"references":[{"url":"https://github.com/systemd/systemd/issues/15985","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20200611-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13776","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63"},{"url":"https://security.netapp.com/advisory/ntap-20200611-0003"},{"url":"https://github.com/advisories/GHSA-g2fm-j5p3-x5h7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13776","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0304.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27043","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1611","tags":["web","advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1538","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1740657","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1755287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1764282","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1812972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819868","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1862714","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1865840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868831","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1870638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1871139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1880270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1885553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1887181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1888912","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1889996","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1611.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3842","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3842","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13776","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13776","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3900","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3900.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1611","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-13776","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-13776","description":"systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.","status":"published","published":"2020-06-03T02:05:22Z","modified":"2026-10-14T09:23:38.933Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2020-5993","description":"systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.","status":"published","published":"2020-06-03T02:05:22Z","modified":"2026-10-14T09:23:38Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:16.85534Z"}],"ghsa":[{"id":"GHSA-g2fm-j5p3-x5h7","title":"systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x...","description":"systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.","status":"published","published":"2022-05-24T17:19:03Z","modified":"2026-10-14T12:32:21Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:13:24.188405Z"}],"nvd":[{"id":"CVE-2020-13776","description":"systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.","status":"published","published":"2020-06-03T03:15:10.677Z","modified":"2026-10-14T10:17:28.897Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.2,"vector":"AV:L/AC:H/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:06:04.922138Z"}],"osv":[{"id":"CVE-2020-13776","description":"systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.","status":"published","published":"2020-06-03T03:15:10.677Z","modified":"2026-10-24T10:50:37.270417Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-13776","description":"systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.","status":"published","published":"2020-06-03T03:15:10.677Z","modified":"2026-10-26T12:00:35.125556948Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"OESA-2022-1538","title":"systemd security update","description":"systemd is a system and service manager that runs as PID 1 and starts the rest of the system.\r\n\r\nSecurity Fix(es):\r\n\r\nsystemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.(CVE-2020-13776)","status":"published","published":"2022-02-26T11:04:49Z","modified":"2026-08-18T01:16:26.505283608Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2021:1611","title":"Red Hat Security Advisory: systemd security, bug fix, and enhancement update","status":"published","published":"2024-09-16T04:59:34Z","modified":"2025-11-22T12:20:04Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:3900","title":"Red Hat Security Advisory: systemd security update","status":"published","published":"2024-09-16T04:59:41Z","modified":"2025-11-22T12:25:32Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:1611","title":"Moderate: systemd security, bug fix, and enhancement update","description":"The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.\n\nSecurity Fix(es):\n\n* systemd: Spoofing of XDG_SEAT allows for actions to be checked against \"allow_active\" instead of \"allow_any\" (CVE-2019-3842)\n\n* systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits (CVE-2020-13776)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T05:39:12Z","modified":"2026-02-04T21:15:07.506126Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-13776","description":"systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.","status":"published","published":"2020-06-03T03:15:00Z","modified":"2026-10-17T12:55:51.333360141Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"MGASA-2021-0304","title":"Updated systemd packages fix a security vulnerability","description":"A flaw was found in systemd, where it mishandles numerical usernames beginning\nwith decimal digits, or \"0x\" followed by hexadecimal digits. When the usernames\nare used by systemd, for example in service units, an unexpected user may be\nused instead. In some particular configurations, this flaw allows local\nattackers to elevate their privileges (CVE-2020-13776).\n","status":"published","published":"2021-06-30T23:58:41Z","modified":"2026-04-16T04:43:35.330938863Z","updated_at":"2026-11-02T15:49:41.509337Z"}]}}