CVE-2019-3811: Debian Linux

Medium severity, CVSS 5.2. EPSS: 0.7% chance of exploitation in the next 30 days.

A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.

Affected products

• Debian Debian Linux: version 8.0 only
• Fedoraproject Fedora: affected versions not specified
• Fedoraproject Sssd: before 2.1 (fixed in 2.1)
• Opensuse Leap: version 15.0 only; version 42.3 only
• Red Hat Enterprise Linux: version 7.0 only

Published 2019-01-15. Last modified 2026-06-17.