ID

VAR-201904-0347

CVE

CVE-2019-3842

TITLE

systemd Vulnerabilities related to authorization, permissions, and access control

DESCRIPTION

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any". systemd Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Systemd is a Linux-based system and service manager for Lennart Poettering software developers in Germany. The product is compatible with SysV and LSB startup scripts and provides a framework for representing dependencies between system services. A license and access control vulnerability exists in the systemdv242-rc4 release that stems from the lack of effective permissions and access control measures for network systems or products. An attacker could exploit this vulnerability to gain access to webmasters. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: systemd security, bug fix, and enhancement update Advisory ID: RHSA-2021:1611-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:1611 Issue date: 2021-05-18 CVE Names: CVE-2019-3842 CVE-2020-13776 ==================================================================== 1. Summary: An update for systemd is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any" (CVE-2019-3842) * systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits (CVE-2020-13776) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1668521 - CVE-2019-3842 systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any" 1740657 - [RFE] NUMA aware CPU affinity setting in systemd unit files 1755287 - localectl set-locale should issue an error message when trying to set a nonexistent locale 1764282 - systemd[XXXXX]: Failed to connect to API bus: Connection refused 1812972 - backport request: allow instantiated units to be enabled via presets 1819868 - systemd excessively reads mountinfo and udev is dense OpenShift environments 1845534 - CVE-2020-13776 systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits 1862714 - LIBSYSTEMD_VERSION value format change crashes systemd-python pip install 1865840 - systemd-tmpfiles request for backport 1868831 - FreezerState is incorrectly updated on system running cgroup v1 1868877 - Enabling the smack feature on the host may cause the container to fail to start 1870638 - RFE: Add an option to Socket units to clear the data before listening again 1871139 - [systemd] systemd-resolved.service:33: Unknown lvalue 'ProtectSystems' in section 'Service' 1880270 - "Failed to start user service, ignoring" when masking user@.service 1885553 - "systemd --user" can dump core upon session closing 1887181 - Backport PassPacketInfo= support into systemd of RHEL 8 1888912 - SELinux policy change not visible to systemd until daemon-reexec 1889996 - backport vconsole-setup: downgrade log message when setting font fails on dummy console 6. Package List: Red Hat Enterprise Linux BaseOS (v. 8): Source: systemd-239-45.el8.src.rpm aarch64: systemd-239-45.el8.aarch64.rpm systemd-container-239-45.el8.aarch64.rpm systemd-container-debuginfo-239-45.el8.aarch64.rpm systemd-debuginfo-239-45.el8.aarch64.rpm systemd-debugsource-239-45.el8.aarch64.rpm systemd-devel-239-45.el8.aarch64.rpm systemd-journal-remote-239-45.el8.aarch64.rpm systemd-journal-remote-debuginfo-239-45.el8.aarch64.rpm systemd-libs-239-45.el8.aarch64.rpm systemd-libs-debuginfo-239-45.el8.aarch64.rpm systemd-pam-239-45.el8.aarch64.rpm systemd-pam-debuginfo-239-45.el8.aarch64.rpm systemd-tests-239-45.el8.aarch64.rpm systemd-tests-debuginfo-239-45.el8.aarch64.rpm systemd-udev-239-45.el8.aarch64.rpm systemd-udev-debuginfo-239-45.el8.aarch64.rpm ppc64le: systemd-239-45.el8.ppc64le.rpm systemd-container-239-45.el8.ppc64le.rpm systemd-container-debuginfo-239-45.el8.ppc64le.rpm systemd-debuginfo-239-45.el8.ppc64le.rpm systemd-debugsource-239-45.el8.ppc64le.rpm systemd-devel-239-45.el8.ppc64le.rpm systemd-journal-remote-239-45.el8.ppc64le.rpm systemd-journal-remote-debuginfo-239-45.el8.ppc64le.rpm systemd-libs-239-45.el8.ppc64le.rpm systemd-libs-debuginfo-239-45.el8.ppc64le.rpm systemd-pam-239-45.el8.ppc64le.rpm systemd-pam-debuginfo-239-45.el8.ppc64le.rpm systemd-tests-239-45.el8.ppc64le.rpm systemd-tests-debuginfo-239-45.el8.ppc64le.rpm systemd-udev-239-45.el8.ppc64le.rpm systemd-udev-debuginfo-239-45.el8.ppc64le.rpm s390x: systemd-239-45.el8.s390x.rpm systemd-container-239-45.el8.s390x.rpm systemd-container-debuginfo-239-45.el8.s390x.rpm systemd-debuginfo-239-45.el8.s390x.rpm systemd-debugsource-239-45.el8.s390x.rpm systemd-devel-239-45.el8.s390x.rpm systemd-journal-remote-239-45.el8.s390x.rpm systemd-journal-remote-debuginfo-239-45.el8.s390x.rpm systemd-libs-239-45.el8.s390x.rpm systemd-libs-debuginfo-239-45.el8.s390x.rpm systemd-pam-239-45.el8.s390x.rpm systemd-pam-debuginfo-239-45.el8.s390x.rpm systemd-tests-239-45.el8.s390x.rpm systemd-tests-debuginfo-239-45.el8.s390x.rpm systemd-udev-239-45.el8.s390x.rpm systemd-udev-debuginfo-239-45.el8.s390x.rpm x86_64: systemd-239-45.el8.i686.rpm systemd-239-45.el8.x86_64.rpm systemd-container-239-45.el8.i686.rpm systemd-container-239-45.el8.x86_64.rpm systemd-container-debuginfo-239-45.el8.i686.rpm systemd-container-debuginfo-239-45.el8.x86_64.rpm systemd-debuginfo-239-45.el8.i686.rpm systemd-debuginfo-239-45.el8.x86_64.rpm systemd-debugsource-239-45.el8.i686.rpm systemd-debugsource-239-45.el8.x86_64.rpm systemd-devel-239-45.el8.i686.rpm systemd-devel-239-45.el8.x86_64.rpm systemd-journal-remote-239-45.el8.x86_64.rpm systemd-journal-remote-debuginfo-239-45.el8.i686.rpm systemd-journal-remote-debuginfo-239-45.el8.x86_64.rpm systemd-libs-239-45.el8.i686.rpm systemd-libs-239-45.el8.x86_64.rpm systemd-libs-debuginfo-239-45.el8.i686.rpm systemd-libs-debuginfo-239-45.el8.x86_64.rpm systemd-pam-239-45.el8.x86_64.rpm systemd-pam-debuginfo-239-45.el8.i686.rpm systemd-pam-debuginfo-239-45.el8.x86_64.rpm systemd-tests-239-45.el8.x86_64.rpm systemd-tests-debuginfo-239-45.el8.i686.rpm systemd-tests-debuginfo-239-45.el8.x86_64.rpm systemd-udev-239-45.el8.x86_64.rpm systemd-udev-debuginfo-239-45.el8.i686.rpm systemd-udev-debuginfo-239-45.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-3842 https://access.redhat.com/security/cve/CVE-2020-13776 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYKPtN9zjgjWX9erEAQh1fw/9G0b1Nor53kXGEjIF5mkaTXpmJWYf1e+f 7fs7L0GIw5ecxzTx0dltY8yR2tLsGoGcCxHFQlTIBULu57RsHbR+cHsTG4iAMCW5 tFC1/CCNftao0Gr8LQu3a/XoIDQX3mKEvjly1Ry0g2nw/C126e0YYJwqPGRn7eIJ K98tUTD+wYd+UT+DKNBXmbc51+nZ4L+Bt2goBtc0NPxBI8IkpNExUmZV6e9UAxl6 dznK/EIjmCQucrfpEeg1c0DnxZIGU3zIfIM8C+s9vyeyKSfY0tdY++FcOQBMz5ms 8MG3CykDZWxnBJ4w9ta052BV7yYeJFHxpkMKR1q9JkAJj1zhnoDhm3v0l6qkrhrG oJfwkgZEbZkCXeixa2R7VO7aHhmdcpurv3RaBebRX5OvPdjppjkeKtxW/mp8BeSB XQPhIUpxPR2KZnjwY9P9AnUFq549BsPs9wHSSxagQaY+GRu7nLs2R0I4QD/KGsvB CG/Nm0xBCq9brFYTPFyTa9bPpqCMwWDqJlAFuO9+5fhvIiVQLHaovzMlOJOyKBUm /JMZ2s3azB6pLD/fiG+tmc4dNJ/bhC37n9++9zWG3USy3f33f/m7ELVGG2eVZ2mh W+vmCuFPoHokguaVkorCXEc5tT6tEKpsYqvPfa80GAEBadEQAjqFyg4AtBL5z4jx gSR+956dHOo=K4AI -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Bugs fixed (https://bugzilla.redhat.com/): 1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation 5. Bug Fix(es): * WMCO patch pub-key-hash annotation to Linux node (BZ#1945248) * LoadBalancer Service type with invalid external loadbalancer IP breaks the datapath (BZ#1952917) * Telemetry info not completely available to identify windows nodes (BZ#1955319) * WMCO incorrectly shows node as ready after a failed configuration (BZ#1956412) * kube-proxy service terminated unexpectedly after recreated LB service (BZ#1963263) 3. Solution: For Windows Machine Config Operator upgrades, see the following documentation: https://docs.openshift.com/container-platform/4.7/windows_containers/window s-node-upgrades.html 4. Bugs fixed (https://bugzilla.redhat.com/): 1945248 - WMCO patch pub-key-hash annotation to Linux node 1946538 - CVE-2021-25736 kubernetes: LoadBalancer Service type don't create a HNS policy for empty or invalid external loadbalancer IP, what could lead to MITM 1952917 - LoadBalancer Service type with invalid external loadbalancer IP breaks the datapath 1955319 - Telemetry info not completely available to identify windows nodes 1956412 - WMCO incorrectly shows node as ready after a failed configuration 1963263 - kube-proxy service terminated unexpectedly after recreated LB service 5. Bugs fixed (https://bugzilla.redhat.com/): 1897635 - CVE-2020-28362 golang: math/big: panic during recursive division of very large numbers 1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve 5. JIRA issues fixed (https://issues.jboss.org/): TRACING-1725 - Elasticsearch operator reports x509 errors communicating with ElasticSearch in OpenShift Service Mesh project 6. Bugs fixed (https://bugzilla.redhat.com/): 1937901 - CVE-2021-27918 golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader 1958341 - CVE-2021-31525 golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header 1965503 - CVE-2021-33196 golang: archive/zip: Malformed archive may cause panic or memory exhaustion 1971445 - Release of OpenShift Serverless Serving 1.16.0 1971448 - Release of OpenShift Serverless Eventing 1.16.0 5. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.7.13. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2021:2122 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel ease-notes.html This update fixes the following bug among others: * Previously, resources for the ClusterOperator were being created early in the update process, which led to update failures when the ClusterOperator had no status condition while Operators were updating. This bug fix changes the timing of when these resources are created. As a result, updates can take place without errors. (BZ#1959238) Security Fix(es): * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121) You may download the oc tool and use it to inspect release image metadata as follows: (For x86_64 architecture) $ oc adm release info quay.io/openshift-release-dev/ocp-release:4.7.13-x86_64 The image digest is sha256:783a2c963f35ccab38e82e6a8c7fa954c3a4551e07d2f43c06098828dd986ed4 (For s390x architecture) $ oc adm release info quay.io/openshift-release-dev/ocp-release:4.7.13-s390x The image digest is sha256:4cf44e68413acad063203e1ee8982fd01d8b9c1f8643a5b31cd7ff341b3199cd (For ppc64le architecture) $ oc adm release info quay.io/openshift-release-dev/ocp-release:4.7.13-ppc64le The image digest is sha256:d47ce972f87f14f1f3c5d50428d2255d1256dae3f45c938ace88547478643e36 All OpenShift Container Platform 4.7 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster - -between-minor.html#understanding-upgrade-channels_updating-cluster-between - -minor 3. Solution: For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel ease-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster - -cli.html 4. Bugs fixed (https://bugzilla.redhat.com/): 1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation 1923268 - [Assisted-4.7] [Staging] Using two both spelling "canceled" "cancelled" 1947216 - [AWS] Missing iam:ListAttachedRolePolicies permission in permissions.go 1953963 - Enable/Disable host operations returns cluster resource with incomplete hosts list 1957749 - ovn-kubernetes pod should have CPU and memory requests set but not limits 1959238 - CVO creating cloud-controller-manager too early causing upgrade failures 1960103 - SR-IOV obliviously reboot the node 1961941 - Local Storage Operator using LocalVolume CR fails to create PV's when backend storage failure is simulated 1962302 - packageserver clusteroperator does not set reason or message for Available condition 1962312 - Deployment considered unhealthy despite being available and at latest generation 1962435 - Public DNS records were not deleted when destroying a cluster which is using byo private hosted zone 1963115 - Test verify /run filesystem contents failing 5. A remote attacker with SSH access can take advantage of this issue to gain PolicyKit privileges that are normally only granted to clients in an active session on the local console. For the stable distribution (stretch), this problem has been fixed in version 232-25+deb9u11. We recommend that you upgrade your systemd packages. For the detailed security status of systemd please refer to its security tracker page at: https://security-tracker.debian.org/tracker/systemd Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlyrsfpfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0S19A//eYZPzdFbJILUh0RBa2uZAxRHrOBIb/UsDKVPu4wZrMJdPGHSZoL+R2RQ Tm1xLhFU+dgMLjfx1n70NIvg5hjPRrhD+6A8QVeU5IcsrMm7cSEFAgj3H5Cok+SN OndAGXQ/EoRrSTDUjnNA7x4H3oxlsnH8nnY4vMqLezlPimMve+hsUSmB/ggDfB9M FoZX35xUsSb/VvxdLqdVM7SFpti63XzAyYOueshaseGNR76rXkaPbXBSpzmcOhaz 9f08i1XG0IeojM0iHzBvOR8skicAPIwFXVLTCt1QE3nqzYeRhZAcq5yifAVm0A6G qzVihq36Sw1roz5uI95x/jBd+odLbSZBG3a7py7jMDsWi8lRkD3kftQVsF9OmUgE FaJtVKCydcWDRA9zWDLMG/6XqRIpDviK8DY/9dq6VkG6VHswobMs87LsrKrdb1tC SqIV2n0mvsUs+BeMI1DDZbJuoXKjHi+3hS+wLFrZ/TM+riAuUq4KbfbSR9JLQdVS D9Vq4J+hECgquS7c/YjmwNm2IdK4R8oSYs410AOmaWB/1xPzn5u5j4HMe3D6DJ6h 8H20PL1O6npyJOWGNimfZDGoxTR87Qfv72v5s59FtJzSVxGLaynsgIv0+ZO0SGH7 80/FYzsd0O4AtrZhjF0jxhwcCmCDMfNO1rEm/whQkmPhdLNxgTM=flwI -----END PGP SIGNATURE-----

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

authorization issue

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2026-01-15T22:10:29.614000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE