Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
m Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3826 - https://github.com/prometheus/prometheus/pull/5163 - https://github.com/prometheus/prometheus/commit/62e591f9 - https://access.redhat.com/errata/RHBA-2019:0327 - https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E - https://advisory.checkmarx.net/advisory/CX-2019-4
20a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E - https://advisory.checkmarx.net/advisory/CX-2019-4297
CVE ID: CVE-2019-3827 State: PUBLISHED Published: 2019-03-25T17:47:35 Last Updated: 2024-08-04T19:19:18.554Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: gvfs Problem Types: CWE-863 Description: An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploi
the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3827 - https://gitlab.gnome.org/GNOME/gvfs/merge_requests/31 - https://access.redhat.com/errata/RHSA-2019:1517 - https://access.redhat.com/errata/RHSA-2019:2145
CVE ID: CVE-2019-3828 State: PUBLISHED Published: 2019-03-27T00:00:00 Last Updated: 2024-08-04T19:19:18.580Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: Ansible Problem Types: CWE-22 Description: Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ansible/ansible/pull/52133 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3828 - http://lists.opensuse.org/
.com/ansible/ansible/pull/52133 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3828 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html - https://usn.ubuntu.com/4072-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html - https://access.redhat.com/errata/RHSA-2019:3744 - https://access.redhat.com/errata/RHSA-2019:3789 - http://packetstormsecurity.com/files/172837/Ansible-Fetch-Path-Traversal.html
CVE ID: CVE-2019-3829 State: PUBLISHED Published: 2019-03-27T17:24:17 Last Updated: 2024-08-04T19:19:18.605Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: gnutls Products: gnutls Problem Types: CWE-416 Description: A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3829 -
ps://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3829 - https://gitlab.com/gnutls/gnutls/issues/694 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WRSOL66LHP4SD3Y2ECJDOGT4K663ECDU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7TJIBRJWGWSH6XIO2MXIQ3W6ES4R6I4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3ETBUFBB4G7AITAOUYPGXVMBGVXKUAN/ - https://security.gentoo.org/glsa/201904-14 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html - https://usn.
ty.gentoo.org/glsa/201904-14 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html - https://usn.ubuntu.com/3999-1/ - https://security.netapp.com/advisory/ntap-20190619-0004/ - https://access.redhat.com/errata/RHSA-2019:3600
CVE ID: CVE-2019-3830 State: PUBLISHED Published: 2019-03-26T17:55:47 Last Updated: 2024-08-04T19:19:18.667Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: openstack-ceilometer Problem Types: CWE-532 Description: A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3830 - https://access.redhat.com/errata/RHSA-2019:0919
CVE ID: CVE-2019-3831 State: PUBLISHED Published: 2019-03-25T17:12:10 Last Updated: 2024-08-04T19:19:18.593Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: vdsm Problem Types: CWE-863 Description: A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could be abused to execute arbitrary commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3831
CVE ID: CVE-2019-3832 State: PUBLISHED Published: 2019-03-20T20:00:27 Last Updated: 2024-08-04T19:19:18.550Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: [UNKNOWN] Products: libsndfile Problem Types: CWE-125 Description: It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of a buffer in wav_write_header() function in wav.c. A local attacker may use this flaw to make the application crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3832 - https://github.com/erikd/libsndfile/issues/456 - https://github.com/erikd/libsndfile
com/show_bug.cgi?id=CVE-2019-3832 - https://github.com/erikd/libsndfile/issues/456 - https://github.com/erikd/libsndfile/pull/460 - https://usn.ubuntu.com/4013-1/ - https://security.gentoo.org/glsa/202007-65 - https://lists.debian.org/debian-lts-announce/2020/10/msg00030.html
CVE ID: CVE-2019-3833 State: PUBLISHED Published: 2019-03-14T22:00:00 Last Updated: 2024-08-04T19:19:18.599Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: openwsman Problem Types: CWE-835 Description: Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.suse.com/show_bug.cgi?id=1122623 - http://www.securityfocus.com/bid
CVE Program Container: References: - http://bugzilla.suse.com/show_bug.cgi?id=1122623 - http://www.securityfocus.com/bid/107367 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3833 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V5HJ355RSKMFQ7GRJAHRZNDVXASF7TA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B2HEZ7D7GF3HDF36JLGYXIK5URR66DS4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CXQP7UDPRZIZ4LM7FEJCTC2EDUYVOR2J/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00006.html - http://lists.opensuse.org/opensuse
VOR2J/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00065.html
CVE ID: CVE-2019-3834 State: PUBLISHED Published: 2019-10-03T13:31:06 Last Updated: 2024-08-04T19:19:18.590Z Severity: MEDIUM (CVSS 5.6 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: RedHat Products: struts Problem Types: CWE-470 Description: It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products
in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3834
CVE ID: CVE-2019-3835 State: PUBLISHED Published: 2019-03-25T18:30:31 Last Updated: 2024-08-04T19:19:18.577Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: The ghostscript Project Products: ghostscript Problem Types: CWE-648 Description: It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3835 - https://bugs.ghostscript.com/show_b
Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3835 - https://bugs.ghostscript.com/show_bug.cgi?id=700585 - https://access.redhat.com/errata/RHSA-2019:0652 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVERLGEU3OV6RNZ2SIBXREWD3BF5H23N/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANBSCZABXQUEQWIKNWJ35IYX24M227EI/ - https://seclists.org/bugtraq/2019/Apr/4 - http://packetstormsecurity.com/files/152367/Slackware-Security-Advisory-ghostscript-Updates.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A43SRQA
-Updates.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A43SRQAEHQCKSEMIBINHUNIGHTDCZD7F/ - https://www.debian.org/security/2019/dsa-4432 - https://seclists.org/bugtraq/2019/Apr/28 - http://www.securityfocus.com/bid/107855 - https://lists.debian.org/debian-lts-announce/2019/04/msg00021.html - https://access.redhat.com/errata/RHSA-2019:0971 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html - https://security.gentoo.org/glsa/202004-03
CVE ID: CVE-2019-3836 State: PUBLISHED Published: 2019-04-01T14:16:51 Last Updated: 2024-08-04T19:19:18.612Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: gnutls Products: gnutls Problem Types: CWE-456 Description: It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3836 - https://gitlab.com/gnutls/gnutls/issues/704 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproj
/gitlab.com/gnutls/gnutls/issues/704 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3ETBUFBB4G7AITAOUYPGXVMBGVXKUAN/ - https://security.gentoo.org/glsa/201904-14 - https://security.netapp.com/advisory/ntap-20190502-0005/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html - https://usn.ubuntu.com/3999-1/ - https://access.redhat.com/errata/RHSA-2019:3600
CVE ID: CVE-2019-3837 State: PUBLISHED Published: 2019-04-11T14:37:26 Last Updated: 2024-08-04T19:19:18.565Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: The Linux Foundation Products: kernel Problem Types: CWE-362 Description: It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption. Additional Analyst Notes: - CVE Program Containe
ost leading to a denial-of-service or cause a random memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3837
CVE ID: CVE-2019-3838 State: PUBLISHED Published: 2019-03-25T18:30:25 Last Updated: 2024-08-04T19:19:18.540Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: The ghostscript Project Products: ghostscript Problem Types: CWE-648 Description: It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3838 - https://bugs.ghostscript.co
Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3838 - https://bugs.ghostscript.com/show_bug.cgi?id=700576 - https://access.redhat.com/errata/RHSA-2019:0652 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVERLGEU3OV6RNZ2SIBXREWD3BF5H23N/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANBSCZABXQUEQWIKNWJ35IYX24M227EI/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00011.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00018.html - https://seclists.org/bugtraq/2019/Apr/4 - http://packetstormsecurity.com/files/1523
ity-announce/2019-04/msg00018.html - https://seclists.org/bugtraq/2019/Apr/4 - http://packetstormsecurity.com/files/152367/Slackware-Security-Advisory-ghostscript-Updates.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A43SRQAEHQCKSEMIBINHUNIGHTDCZD7F/ - https://www.debian.org/security/2019/dsa-4432 - https://seclists.org/bugtraq/2019/Apr/28 - https://lists.debian.org/debian-lts-announce/2019/04/msg00021.html - https://access.redhat.com/errata/RHSA-2019:0971 - https://security.gentoo.org/glsa/202004-03
CVE ID: CVE-2019-3839 State: PUBLISHED Published: 2019-05-16T18:31:08 Last Updated: 2024-08-04T19:19:18.593Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: The ghostscript Project Products: ghostscript Problem Types: CWE-648 Description: It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/er
efore 9.27 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0971 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3839 - https://access.redhat.com/errata/RHSA-2019:1017 - https://usn.ubuntu.com/3970-1/ - https://www.debian.org/security/2019/dsa-4442 - https://seclists.org/bugtraq/2019/May/23 - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=4ec9ca74bed49f2a82acb4bf430eae0d8b3b75c9 - https://lists.debian.org/debian-lts-announce/2019/05/msg00023.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/ - https://lists.fed
g/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html
CVE ID: CVE-2019-3840 State: PUBLISHED Published: 2019-03-27T12:24:10 Last Updated: 2024-08-04T19:19:18.580Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H) Vendors: The libvirt Project Products: libvirt Problem Types: CWE-476 Description: A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3840 - https://bugzilla.redhat.com/show_bug.cgi?id=1663051 - https://www.redhat.
lla.redhat.com/show_bug.cgi?id=CVE-2019-3840 - https://bugzilla.redhat.com/show_bug.cgi?id=1663051 - https://www.redhat.com/archives/libvir-list/2019-January/msg00241.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00101.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00105.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZRP2BRMI4RYFRPNFTTIAAUOGVN2ORP7/ - https://access.redhat.com/errata/RHSA-2019:2294
CVE ID: CVE-2019-3841 State: PUBLISHED Published: 2019-03-25T17:03:28 Last Updated: 2024-08-04T19:19:18.689Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: The Kubevirt project Products: kubevirt/virt-cdi-importer Problem Types: CWE-295 Description: Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible undetected tampering of trusted container image content. Additional Analyst Notes: - CVE Program Container: References: - ht
tected tampering of trusted container image content. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubevirt/containerized-data-importer/issues/678 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3841
CVE ID: CVE-2019-3842 State: PUBLISHED Published: 2019-04-09T20:25:01.000Z Last Updated: 2025-06-09T15:47:28.243Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: The systemd Project Products: systemd Problem Types: CWE-285 Description: In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any". Additional Analyst Notes: - CVE Program Container: - CISA AD
s using the "allow_active" element rather than "allow_any". Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/ - https://www.exploit-db.com/exploits/46743/ - http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html - https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a13
org/opensuse-security-announce/2019-05/msg00062.html - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2019-3843 State: PUBLISHED Published: 2019-04-26T20:27:30.000Z Last Updated: 2025-06-09T15:49:53.235Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: [freedesktop.org] Products: systemd Problem Types: CWE-266 Description: It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
n the future, when the UID/GID will be recycled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3843 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5JXQAKSTMABZ46EVCRMW62DHWYHTTFES/ - http://www.securityfocus.com/bid/108116 - https://security.netapp.com/advisory/ntap-20190619-0002/ - https://usn.ubuntu.com/4269-1/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3C
CVE ID: CVE-2019-3844 State: PUBLISHED Published: 2019-04-26T20:26:53.000Z Last Updated: 2025-06-09T15:49:20.110Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: [freedesktop.org] Products: systemd Problem Types: CWE-268 Description: It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled. Additional Analyst Notes: - CVE Program Con
potentially different service in the future, when the GID will be recycled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844 - http://www.securityfocus.com/bid/108096 - https://security.netapp.com/advisory/ntap-20190619-0002/ - https://usn.ubuntu.com/4269-1/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E