CVE-2019-3842: Debian Linux

High severity, CVSS 7.0. EPSS: 1.2% chance of exploitation in the next 30 days.

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".

Affected products

• Debian Debian Linux: version 8.0 only
• Fedoraproject Fedora: version 30 only
• Red Hat Enterprise Linux: version 7.0 only
• Systemd Project Systemd: up to and including 241; version 242 only

Published 2019-04-09. Last modified 2026-06-17.