Description
It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the user web shares (~/public_html), which could result in privilege escalation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Debian | debian-edu-config | < 2.12.16 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | debian-edu-config | 2.12.16 | — |
| Debian 12 | debian-edu-config | 2.12.16 | — |
| Debian 11 | debian-edu-config | 2.11.56+deb11u3 | DSA-5072-1 |
| Debian 10 | debian-edu-config | 2.10.65+deb10u8 | DSA-5072-1 |
| Debian 9 | debian-edu-config | 1.929+deb9u5 | DLA-2918-1 |
Advisories 2
- DSA-5072-1 debian-edu-config - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2918-1 debian-edu-config - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/4d39a5888d193567704238f8c035f8d17cfe34e5
- [debian-lts-announce] 20220211 [SECURITY] [DLA 2918-1] debian-edu-config security update mailing-list
- [debian-security-announce] 20220211 [SECURITY] [DSA 5072-1] debian-edu-config security update mailing-list
- DSA-5072 vendor-advisory