kritisch
CVE-2019-3689
nfs-utils: root-owned files stored in insecure /var/lib/nfs
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (mittel), Ubuntu (niedrig).
Beschreibung
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 10 | nfs-utils | 1:1.3.4-2.5+deb10u1 |
| debian 11 | nfs-utils | 1:1.3.4-3 |
| debian 12 | nfs-utils | 1:1.3.4-3 |
| debian 13 | nfs-utils | 1:1.3.4-3 |
| debian 14 | nfs-utils | 1:1.3.4-3 |
| debian 8 | nfs-utils | 1:1.2.8-9+deb8u1 |
| debian 9 | nfs-utils | 1:1.3.4-2.1+deb9u1 |
| echo | nfs-utils | 1:1.3.4-3 |
| ubuntu 16.04 | nfs-utils | 1:1.2.8-9ubuntu12.3 |
| ubuntu 16.04-ESM | nfs-utils | 1:1.2.8-9ubuntu12.3 |
| ubuntu 18.04 | nfs-utils | 1:1.3.4-2.1ubuntu5.3 |
| ubuntu 18.04-ESM | nfs-utils | 1:1.3.4-2.1ubuntu5.3 |
Alle 28 Einträge aus 28 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 10 | nfs-utils | 1:1.3.4-2.5+deb10u1 |
| debian 11 | nfs-utils | 1:1.3.4-3 |
| debian 12 | nfs-utils | 1:1.3.4-3 |
| debian 13 | nfs-utils | 1:1.3.4-3 |
| debian 14 | nfs-utils | 1:1.3.4-3 |
| debian 8 | nfs-utils | 1:1.2.8-9+deb8u1 |
| debian 9 | nfs-utils | 1:1.3.4-2.1+deb9u1 |
| echo | nfs-utils | 1:1.3.4-3 |
| ubuntu 16.04 | nfs-utils | 1:1.2.8-9ubuntu12.3 |
| ubuntu 16.04-ESM | nfs-utils | 1:1.2.8-9ubuntu12.3 |
| ubuntu 18.04 | nfs-utils | 1:1.3.4-2.1ubuntu5.3 |
| ubuntu 18.04-ESM | nfs-utils | 1:1.3.4-2.1ubuntu5.3 |
| ubuntu 19.10 | nfs-utils | 1:1.3.4-2.5ubuntu2.1 |
| ubuntu 20.04 | nfs-utils | 1:1.3.4-2.5ubuntu3.3 |
| ubuntu 20.04-ESM | nfs-utils | 1:1.3.4-2.5ubuntu3.3 |
| ubuntu 20.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 21.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 21.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 22.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 22.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 23.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 23.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 24.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 24.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 25.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 25.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 26.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 26.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
Referenzen
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00071.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00006.html
- https://access.redhat.com/security/cve/CVE-2019-3689
- https://bugzilla.suse.com/show_bug.cgi?id=1150733
- https://git.linux-nfs.org/?p=steved/nfs-utils.git%3Ba=commitdiff%3Bh=fee2cc29e888f2ced6a76990923aef19d326dc0e
- https://lists.debian.org/debian-lts-announce/2019/10/msg00026.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-3689
- https://ubuntu.com/security/notices/USN-4400-1