CVE-2019-3842

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-3842
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-3842.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-3842
Downstream
Related
Published
2019-04-09T21:29:03.443Z
Modified
2026-05-28T04:04:44.740666545Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In systemd before v242-rc4, it was discovered that pamsystemd does not properly sanitize the environment before using the XDGSEAT variable. It is possible for an attacker, in some particular configurations, to set a XDGSEAT environment variable which allows for commands to be checked against polkit policies using the "allowactive" element rather than "allow_any".

Database specific 
{
    "unresolved_ranges": [
        {
            "vendor_product": "debian:debian_linux",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "last_affected": "8.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "vendor_product": "fedoraproject:fedora",
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "last_affected": "30"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "vendor_product": "redhat:enterprise_linux",
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "last_affected": "7.0"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/systemd/systemd

Affected ranges

Type
GIT
Repo
https://github.com/systemd/systemd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e62a7fea757f259eb330da5b6d3ab4ede46400a2
Last affected
d822bd4e2608399bb7e2d17648b76dc57d9bb783
Last affected
7eb8a47e42a2cac2b4857b435fad4389fcb88555
Last affected
949082ac214409365c01781fbf18ba08593918ff
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "241"
        },
        {
            "last_affected": "242-rc1"
        },
        {
            "last_affected": "242-rc2"
        },
        {
            "last_affected": "242-rc3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:systemd_project:systemd:242:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:systemd_project:systemd:242:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:systemd_project:systemd:242:rc3:*:*:*:*:*:*"
    ]
}

Affected versions

Other
v1
v10
v11
v12
v13
v14
v15
v16
v17
v18
v183
v184
v185
v186
v187
v188
v189
v19
v190
v191
v192
v193
v194
v195
v196
v197
v198
v199
v2
v20
v200
v201
v202
v203
v204
v205
v206
v207
v208
v209
v21
v210
v211
v212
v213
v214
v215
v216
v217
v218
v219
v22
v220
v221
v222
v223
v224
v225
v226
v227
v228
v229
v23
v230
v231
v232
v233
v234
v235
v236
v237
v238
v239
v24
v240
v241
v241-rc1
v241-rc2
v242-rc1
v242-rc2
v242-rc3
v25
v26
v27
v28
v29
v3
v30
v31
v32
v33
v34
v35
v36
v37
v38
v39
v4
v40
v41
v42
v43
v44
v5
v6
v7
v8
v9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-3842.json"

Git / github.com/systemd/systemd-stable

Affected ranges

Type
GIT
Repo
https://github.com/systemd/systemd-stable
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e62a7fea757f259eb330da5b6d3ab4ede46400a2
Last affected
d822bd4e2608399bb7e2d17648b76dc57d9bb783
Last affected
7eb8a47e42a2cac2b4857b435fad4389fcb88555
Last affected
949082ac214409365c01781fbf18ba08593918ff
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "241"
        },
        {
            "last_affected": "242-rc1"
        },
        {
            "last_affected": "242-rc2"
        },
        {
            "last_affected": "242-rc3"
        }
    ],
    "cpe": [
        "cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:systemd_project:systemd:242:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:systemd_project:systemd:242:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:systemd_project:systemd:242:rc3:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

Other
systemd-v1
systemd-v10
systemd-v11
systemd-v12
systemd-v13
systemd-v14
systemd-v15
systemd-v16
systemd-v17
systemd-v18
systemd-v183
systemd-v184
systemd-v185
systemd-v186
systemd-v187
systemd-v188
systemd-v189
systemd-v19
systemd-v190
systemd-v191
systemd-v192
systemd-v193
systemd-v194
systemd-v195
systemd-v196
systemd-v2
systemd-v20
systemd-v21
systemd-v22
systemd-v23
systemd-v24
systemd-v25
systemd-v26
systemd-v27
systemd-v28
systemd-v29
systemd-v3
systemd-v30
systemd-v31
systemd-v32
systemd-v33
systemd-v34
systemd-v35
systemd-v36
systemd-v37
systemd-v38
systemd-v39
systemd-v4
systemd-v40
systemd-v41
systemd-v42
systemd-v43
systemd-v44
systemd-v5
systemd-v6
systemd-v7
systemd-v8
systemd-v9
v1
v10
v11
v12
v13
v14
v15
v16
v17
v18
v183
v184
v185
v186
v187
v188
v189
v19
v190
v191
v192
v193
v194
v195
v196
v197
v198
v199
v2
v20
v200
v201
v202
v203
v204
v205
v206
v207
v208
v209
v21
v210
v211
v212
v213
v214
v215
v216
v217
v218
v219
v22
v220
v221
v222
v223
v224
v225
v226
v227
v228
v229
v23
v230
v231
v232
v233
v234
v235
v236
v237
v238
v239
v24
v240
v241
v241-rc1
v241-rc2
v242-rc1
v242-rc2
v242-rc3
v25
v26
v27
v28
v29
v3
v30
v31
v32
v33
v34
v35
v36
v37
v38
v39
v4
v40
v41
v42
v43
v44
v5
v6
v7
v8
v9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-3842.json"