Description
Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Debian | Debian Edu | all versions < 2.11.10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | debian-edu-config | 2.11.10 | — |
| Debian 12 | debian-edu-config | 2.11.10 | — |
| Debian 10 | debian-edu-config | 2.10.65+deb10u3 | DSA-4589-1 |
| Debian 10 | debian-lan-config | 0.25+deb10u1 | DSA-4595-1 |
| Debian 9 | debian-edu-config | 1.929+deb9u4 | DSA-4589-1 |
| Debian 9 | debian-lan-config | 0.23+deb9u1 | DSA-4595-1 |
| Debian 8 | debian-edu-config | 1.818+deb8u3 | DLA-2041-1 |
| Debian 8 | debian-lan-config | 0.19+deb8u2 | DLA-2063-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | debian-lan-config | 0.26 | — |
| Ubuntu 18.04 LTS | debian-lan-config | 0.23+deb9u1build0.18.04.1 | USN-4530-1 |
| Ubuntu 16.04 LTS | debian-lan-config | No fix yet | — |
Advisories 5
- USN-4530-1 debian-lan-config vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4595-1 debian-lan-config - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4589-1 debian-edu-config - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2041-1 debian-edu-config - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2063-1 debian-lan-config - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- [debian-lts-announce] 20191218 [SECURITY] [DLA 2041-1] debian-edu-config security update mailing-list
- 20191218 [SECURITY] [DSA 4589-1] debian-edu-config security update mailing-list
- DSA-4589 vendor-advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946797
- https://security-tracker.debian.org/tracker/CVE-2019-3467
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947459
- DSA-4595 vendor-advisory
- 20191229 [SECURITY] [DSA 4595-1] debian-lan-config security update mailing-list
- [debian-lts-announce] 20200115 [SECURITY] [DLA 2063-1] debian-lan-config security update mailing-list
- USN-4530-1 vendor-advisory