USN-3938-1
- Source
- https://ubuntu.com/security/notices/USN-3938-1
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3938-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/USN-3938-1
- Upstream
- Related
- Published
- 2019-04-08T19:26:16.126288Z
- Modified
- 2025-10-13T04:34:49Z
- Summary
- systemd vulnerability
- Details
-
Jann Horn discovered that pam_systemd created logind sessions using some parameters from the environment. A local attacker could exploit this in order to spoof the active session and gain additional PolicyKit privileges.
- References
Affected packages
Ubuntu:14.04:LTS / systemd
Package
- Name
- systemd
- Purl
- pkg:deb/ubuntu/systemd@204-5ubuntu20.31?arch=source&distro=trusty
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed204-5ubuntu20.31
Affected versions
Other
204-0ubuntu18
204-0ubuntu19
204-5ubuntu3
204-5ubuntu5
204-5ubuntu6
204-5ubuntu7
204-5ubuntu8
204-5ubuntu9
204-5ubuntu10
204-5ubuntu11
204-5ubuntu13
204-5ubuntu14
204-5ubuntu15
204-5ubuntu16
204-5ubuntu17
204-5ubuntu18
204-5ubuntu19
204-5ubuntu20
204-5ubuntu20.*
204-5ubuntu20.2
204-5ubuntu20.3
204-5ubuntu20.4
204-5ubuntu20.5
204-5ubuntu20.6
204-5ubuntu20.7
204-5ubuntu20.8
204-5ubuntu20.9
204-5ubuntu20.10
204-5ubuntu20.11
204-5ubuntu20.12
204-5ubuntu20.13
204-5ubuntu20.14
204-5ubuntu20.15
204-5ubuntu20.18
204-5ubuntu20.19
204-5ubuntu20.20
204-5ubuntu20.21
204-5ubuntu20.22
204-5ubuntu20.24
204-5ubuntu20.25
204-5ubuntu20.26
204-5ubuntu20.28
204-5ubuntu20.29
Ecosystem specific
{
"binaries": [
{
"binary_version": "1:204-5ubuntu20.31",
"binary_name": "gir1.2-gudev-1.0"
},
{
"binary_version": "1:204-5ubuntu20.31",
"binary_name": "libgudev-1.0-0"
},
{
"binary_version": "1:204-5ubuntu20.31",
"binary_name": "libgudev-1.0-dev"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libpam-systemd"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libsystemd-daemon-dev"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libsystemd-daemon0"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libsystemd-id128-0"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libsystemd-id128-dev"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libsystemd-journal-dev"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libsystemd-journal0"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libsystemd-login-dev"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libsystemd-login0"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libudev-dev"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "libudev1"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "python-systemd"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "systemd"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "systemd-services"
},
{
"binary_version": "204-5ubuntu20.31",
"binary_name": "udev"
}
],
"availability": "No subscription required"
}
Database specific
cves_map
{
"cves": [
{
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"id": "CVE-2019-3842"
}
],
"ecosystem": "Ubuntu:14.04:LTS"
}
Ubuntu:16.04:LTS / systemd
Package
- Name
- systemd
- Purl
- pkg:deb/ubuntu/systemd@229-4ubuntu21.21?arch=source&distro=xenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed229-4ubuntu21.21
Affected versions
Other
225-1ubuntu9
227-2ubuntu1
227-2ubuntu2
228-1ubuntu2
228-2ubuntu1
228-2ubuntu2
228-3ubuntu1
228-4ubuntu1
228-4ubuntu2
228-5ubuntu1
228-5ubuntu2
228-5ubuntu3
228-6ubuntu1
229-1ubuntu2
229-1ubuntu4
229-2ubuntu1
229-3ubuntu1
229-3ubuntu2
229-4ubuntu1
229-4ubuntu4
229-4ubuntu5
229-4ubuntu6
229-4ubuntu7
229-4ubuntu8
229-4ubuntu10
229-4ubuntu11
229-4ubuntu12
229-4ubuntu13
229-4ubuntu16
229-4ubuntu17
229-4ubuntu19
229-4ubuntu20
229-4ubuntu21
229-4ubuntu21.*
229-4ubuntu21.1
229-4ubuntu21.2
229-4ubuntu21.3
229-4ubuntu21.4
229-4ubuntu21.5
229-4ubuntu21.6
229-4ubuntu21.8
229-4ubuntu21.9
229-4ubuntu21.10
229-4ubuntu21.15
229-4ubuntu21.16
229-4ubuntu21.17
229-4ubuntu21.19
Ecosystem specific
{
"binaries": [
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "libnss-myhostname"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "libnss-mymachines"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "libnss-resolve"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "libpam-systemd"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "libsystemd-dev"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "libsystemd0"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "libudev-dev"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "libudev1"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "systemd"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "systemd-container"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "systemd-coredump"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "systemd-journal-remote"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "systemd-sysv"
},
{
"binary_version": "229-4ubuntu21.21",
"binary_name": "udev"
}
],
"availability": "No subscription required"
}
Database specific
cves_map
{
"cves": [
{
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"id": "CVE-2019-3842"
}
],
"ecosystem": "Ubuntu:16.04:LTS"
}
Ubuntu:18.04:LTS / systemd
Package
- Name
- systemd
- Purl
- pkg:deb/ubuntu/systemd@237-3ubuntu10.19?arch=source&distro=bionic
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed237-3ubuntu10.19
Affected versions
Other
234-2ubuntu12
235-2ubuntu3
235-3ubuntu2
235-3ubuntu3
237-3ubuntu3
237-3ubuntu4
237-3ubuntu6
237-3ubuntu7
237-3ubuntu8
237-3ubuntu10
237-3ubuntu10.*
237-3ubuntu10.2
237-3ubuntu10.3
237-3ubuntu10.4
237-3ubuntu10.6
237-3ubuntu10.9
237-3ubuntu10.11
237-3ubuntu10.12
237-3ubuntu10.13
237-3ubuntu10.15
237-3ubuntu10.17
Ecosystem specific
{
"binaries": [
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "libnss-myhostname"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "libnss-mymachines"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "libnss-resolve"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "libnss-systemd"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "libpam-systemd"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "libsystemd-dev"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "libsystemd0"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "libudev-dev"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "libudev1"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "systemd"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "systemd-container"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "systemd-coredump"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "systemd-journal-remote"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "systemd-sysv"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "systemd-tests"
},
{
"binary_version": "237-3ubuntu10.19",
"binary_name": "udev"
}
],
"availability": "No subscription required"
}
Database specific
cves_map
{
"cves": [
{
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"id": "CVE-2019-3842"
}
],
"ecosystem": "Ubuntu:18.04:LTS"
}