crítica
CVE-2019-3689
nfs-utils: root-owned files stored in insecure /var/lib/nfs
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Ubuntu (baja).
Descripción
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 10 | nfs-utils | 1:1.3.4-2.5+deb10u1 |
| debian 11 | nfs-utils | 1:1.3.4-3 |
| debian 12 | nfs-utils | 1:1.3.4-3 |
| debian 13 | nfs-utils | 1:1.3.4-3 |
| debian 14 | nfs-utils | 1:1.3.4-3 |
| debian 8 | nfs-utils | 1:1.2.8-9+deb8u1 |
| debian 9 | nfs-utils | 1:1.3.4-2.1+deb9u1 |
| echo | nfs-utils | 1:1.3.4-3 |
| ubuntu 16.04 | nfs-utils | 1:1.2.8-9ubuntu12.3 |
| ubuntu 16.04-ESM | nfs-utils | 1:1.2.8-9ubuntu12.3 |
| ubuntu 18.04 | nfs-utils | 1:1.3.4-2.1ubuntu5.3 |
| ubuntu 18.04-ESM | nfs-utils | 1:1.3.4-2.1ubuntu5.3 |
Mostrar las 28 entradas de 28 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 10 | nfs-utils | 1:1.3.4-2.5+deb10u1 |
| debian 11 | nfs-utils | 1:1.3.4-3 |
| debian 12 | nfs-utils | 1:1.3.4-3 |
| debian 13 | nfs-utils | 1:1.3.4-3 |
| debian 14 | nfs-utils | 1:1.3.4-3 |
| debian 8 | nfs-utils | 1:1.2.8-9+deb8u1 |
| debian 9 | nfs-utils | 1:1.3.4-2.1+deb9u1 |
| echo | nfs-utils | 1:1.3.4-3 |
| ubuntu 16.04 | nfs-utils | 1:1.2.8-9ubuntu12.3 |
| ubuntu 16.04-ESM | nfs-utils | 1:1.2.8-9ubuntu12.3 |
| ubuntu 18.04 | nfs-utils | 1:1.3.4-2.1ubuntu5.3 |
| ubuntu 18.04-ESM | nfs-utils | 1:1.3.4-2.1ubuntu5.3 |
| ubuntu 19.10 | nfs-utils | 1:1.3.4-2.5ubuntu2.1 |
| ubuntu 20.04 | nfs-utils | 1:1.3.4-2.5ubuntu3.3 |
| ubuntu 20.04-ESM | nfs-utils | 1:1.3.4-2.5ubuntu3.3 |
| ubuntu 20.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 21.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 21.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 22.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 22.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 23.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 23.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 24.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 24.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 25.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 25.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 26.04 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
| ubuntu 26.10 | nfs-utils | 1:1.3.4-2.5ubuntu5 |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00071.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00006.html
- https://access.redhat.com/security/cve/CVE-2019-3689
- https://bugzilla.suse.com/show_bug.cgi?id=1150733
- https://git.linux-nfs.org/?p=steved/nfs-utils.git%3Ba=commitdiff%3Bh=fee2cc29e888f2ced6a76990923aef19d326dc0e
- https://lists.debian.org/debian-lts-announce/2019/10/msg00026.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-3689
- https://ubuntu.com/security/notices/USN-4400-1