CVE-2021-20001

CVE-2021-20001 affects debian-edu-config prior to 2.12.16, where insecure permissions on user web shares (~/public_html) could allow privilege escalation. Debian advisories (DSA-5072-1, DLA-2918-1) document the issue and its fix; for Debian 9, the fix is in 1.929+deb9u5. Multiple feeds (NVD entry...

CVE-2019-3467

CVE-2019-3467 affects Debian-LAN-related components used with Debian Edu: Debian-edu-config versions earlier than 2.11.10 and debian-lan-config earlier than 0.26 were configured with overly permissive ACLs on the Kerberos admin server. This misconfiguration allowed password changes for other Kerb...