CVE-2019-3811

A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.

• CWE-200
• CWE-552

• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00026.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00045.htmlMailing List, Third Party Advisory
• http://www.securityfocus.com/bid/106644Broken Link
• https://access.redhat.com/errata/RHSA-2019:2177Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3811Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/01/msg00011.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html
• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00026.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00045.htmlMailing List, Third Party Advisory
• http://www.securityfocus.com/bid/106644Broken Link
• https://access.redhat.com/errata/RHSA-2019:2177Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3811Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/01/msg00011.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html

Published

Jan 15, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3805A flaw was discovered in wildfly versions up to 16.0.0.Final…4.7
• CVE-2019-3806An issue has been found in PowerDNS Recursor versions after …8.1
• CVE-2019-3807An issue has been found in PowerDNS Recursor versions 4.1.x …3.7
• CVE-2019-3808A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5…5.4
• CVE-2019-3809A flaw was found in Moodle versions 3.1 to 3.1.15 and earlie…6.5
• CVE-2019-3810A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5…6.1
• CVE-2019-3812QEMU, through version 2.10 and through version 3.1.0, is vul…4.4
• CVE-2019-3813Spice, versions 0.5.2 through 0.14.1, are vulnerable to an o…7.5
• CVE-2019-3814It was discovered that Dovecot before versions 2.2.36.1 and …7.7
• CVE-2019-3815A memory leak was discovered in the backport of fixes for CV…3.3
• CVE-2019-3816Openwsman, versions up to and including 2.6.9, are vulnerabl…7.5
• CVE-2019-3817A use-after-free flaw has been discovered in libcomps before…7.5