cbcvebase.
CVE-2017-1000082
published 2017-07-07

CVE-2017-1000082: systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges…

critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.

Affected

16 ranges
VendorProductVersion rangeFixed in
debiansystemd< systemd 246-2 (bookworm)systemd 246-2 (bookworm)
debiansystemd< systemd 234-1 (bookworm)systemd 234-1 (bookworm)
fedoraprojectfedora——
msrccbl_mariner_1.0_arm——
msrccbl_mariner_1.0_x64——
msrccm1_systemd_239-34_on_cbl_mariner_1.0——
systemd_projectsystemd<= 245—
systemd_projectsystemd>= 0 < 246-2246-2
systemd_projectsystemd>= 0 < 234-1234-1
systemd_projectsystemd>= 0 < 246-2246-2
systemd_projectsystemd>= 0 < 234-1234-1
systemd_projectsystemd>= 0 < 246-2246-2
systemd_projectsystemd>= 0 < 234-1234-1
systemd_projectsystemd>= 0 < 246-2246-2
systemd_projectsystemd>= 0 < 234-1234-1
systemd_projectsystemd>= 229 < 234234

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL