CVE-2019-3690
Last modified
CVE-2019-3690 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Opensuse | Leap | 15.1 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.htmlThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1150734Issue Tracking, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.htmlThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1150734Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-3690?
How severe is CVE-2019-3690?
How do I fix CVE-2019-3690?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-3684SUSE Manager until version 4.0.7 and Uyuni until commit 1b42…5.9
- CVE-2019-3685Open Build Service before version 0.165.4 diddn't validate T…7.7
- CVE-2019-3686openQA before commit c172e8883d8f32fced5e02f9b6faaacc913df27…6.1
- CVE-2019-3687The permission package in SUSE Linux Enterprise Server allow…3.3
- CVE-2019-3688The /usr/sbin/pinger binary packaged with squid in SUSE Linu…7.1
- CVE-2019-3689The nfs-utils package in SUSE Linux Enterprise Server 12 bef…9.8
- CVE-2019-3691A Symbolic Link (Symlink) Following vulnerability in the pac…7.8
- CVE-2019-3692The packaging of inn on SUSE Linux Enterprise Server 11; ope…7.8
- CVE-2019-3693A symlink following vulnerability in the packaging of mailma…7.8
- CVE-2019-3694A Symbolic Link (Symlink) Following vulnerability in the pac…7.8
- CVE-2019-3695A Improper Control of Generation of Code vulnerability in th…7.8
- CVE-2019-3696A Improper Limitation of a Pathname to a Restricted Director…7.3
Are you affected by CVE-2019-3690?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST