CVE-2019-3467

unknown

Published — · Modified —

CVSS v3

—

CVSS v2

—

VIR risk

—

Description

Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2019-3467

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2019-3467 NameCVE-2019-3467 DescriptionDebian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE…

CVE-2019-3467

Name	CVE-2019-3467
Description	Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2041-1, DLA-2063-1, DSA-4589-1, DSA-4595-1
Debian Bugs	946797, 947459

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
debian-edu-config (PTS)	bullseye	2.11.56+deb11u4	fixed
	bullseye (security)	2.11.56+deb11u3	fixed
	bookworm	2.12.46~deb12u1	fixed
	trixie	2.12.903~deb13u1	fixed
	forky, sid	2.13.0	fixed
debian-lan-config (PTS)	bullseye	0.28	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
debian-edu-config	source	jessie	1.818+deb8u3	DLA-2041-1
debian-edu-config	source	stretch	1.929+deb9u4	DSA-4589-1
debian-edu-config	source	buster	2.10.65+deb10u3	DSA-4589-1
debian-edu-config	source	(unstable)	2.11.10		946797
debian-lan-config	source	jessie	0.19+deb8u2	DLA-2063-1
debian-lan-config	source	stretch	0.23+deb9u1	DSA-4595-1
debian-lan-config	source	buster	0.25+deb10u1	DSA-4595-1
debian-lan-config	source	(unstable)	0.26		947459

Notes

debian-lan-config is effectively the same issue as in debian-edu-config and a somewhat
derived codebase, so same CVE ID is used

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

debian-lan-config is effectively the same issue as in debian-edu-config and a somewhatderived codebase, so same CVE ID is used

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`2.11.10`
debian	bullseye	fixed	`2.11.10`
debian	forky	fixed	`2.11.10`
debian	sid	fixed	`2.11.10`
debian	trixie	fixed	`2.11.10`

References

https://security-tracker.debian.org/tracker/CVE-2019-3467

Verify integrity in audit chain (admin only). AS-IS.