Description
Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Debian Debian Edu
all versions < 2.11.10affected
References
- https://lists.debian.org/debian-lts-announce/2019/12/msg00023.html ↗
- https://seclists.org/bugtraq/2019/Dec/34 ↗
- https://www.debian.org/security/2019/dsa-4589 ↗
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946797 ↗
- https://security-tracker.debian.org/tracker/CVE-2019-3467 ↗
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947459 ↗
- https://www.debian.org/security/2019/dsa-4595 ↗
- https://seclists.org/bugtraq/2019/Dec/44 ↗
- https://lists.debian.org/debian-lts-announce/2020/01/msg00012.html ↗
- https://usn.ubuntu.com/4530-1/ ↗