CVE-2019-3689
Fixed in a distro release EPSS 2%CVSS 5.1
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
Products: SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | nfs-utils | 1:1.3.4-3 |
| Debian 13 | nfs-utils | 1:1.3.4-3 |
| Debian 14 | nfs-utils | 1:1.3.4-3 |
| Debian 8 | nfs-utils | 1:1.2.8-9+deb8u1 |
| SUSE Enterprise Storage 4 | nfs-utils | 1.3.0-34.22.1 |
| SUSE Enterprise Storage 5 | nfs-utils | 1.3.0-34.22.1 |
| SUSE HPE Helion OpenStack 8 | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | nfs-utils | 2.1.1-6.14.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | nfs-utils | 2.1.1-10.4.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | nfs-utils | 1.3.0-41.3.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Server 12 SP4 | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Server 12 SP5 | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | nfs-utils | 1.3.0-41.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | nfs-utils | 1.3.0-34.22.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | nfs-utils | 1.3.0-34.22.1 |
| SUSE OpenStack Cloud 7 | nfs-utils | 1.3.0-34.22.1 |
| SUSE OpenStack Cloud 8 | nfs-utils | 1.3.0-34.22.1 |
| SUSE OpenStack Cloud Crowbar 8 | nfs-utils | 1.3.0-34.22.1 |
| Ubuntu 14.04 LTS | nfs-utils | no fix |
| Ubuntu 16.04 LTS | nfs-utils | 1:1.2.8-9ubuntu12.3 |
| Ubuntu 18.04 LTS | nfs-utils | 1:1.3.4-2.1ubuntu5.3 |
| Ubuntu 20.04 LTS | nfs-utils | 1:1.3.4-2.5ubuntu3.3 |
| openSUSE Leap 15.0 | nfs-utils | 2.1.1-lp150.4.10.1 |
| openSUSE Leap 15.1 | nfs-utils | 2.1.1-lp151.7.3.1 |
| openSUSE Tumbleweed | nfsidmap | 1.0-26.2 |
| openSUSE Tumbleweed | rpmlint | 2.1+git20210924.ad0cf53-1.1 |