CVE-2019-19191 - Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation

Back Back to CVE browser

HIGH

Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation

Published Nov 21, 2019

7.8

HIGH

CVSS 3.1

EPSS 0.48%

Description

Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-59

References (3)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00017.html
vendor-advisoryx_refsource_SUSE
https://bugzilla.suse.com/show_bug.cgi?id=1157471
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://issues.shibboleth.net/jira/browse/SSPCPP-874
x_refsource_MISCIssue TrackingVendor Advisory

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00017.html		vendor-advisoryx_refsource_SUSE
https://bugzilla.suse.com/show_bug.cgi?id=1157471		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://issues.shibboleth.net/jira/browse/SSPCPP-874		x_refsource_MISCIssue TrackingVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Nov 21, 2019

Updated Aug 5, 2024

Reserved Nov 21, 2019

Link CVE-2019-19191

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-19191

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-19191