CVE-2019-3842

Name of the Vulnerable Software and Affected Versions systemd versions prior to v242-rc4

Description The issue is related to the pam systemd module of the systemd daemon, which fails to properly sanitize the environment before using the XDG SEAT variable. This could allow an attacker, in certain configurations, to set the XDG SEAT environment variable and check commands against polkit policies using the "allow active" element instead of "allow any", potentially impacting the confidentiality, integrity, and availability of protected data.

Recommendations For versions prior to v242-rc4, update to version v242-rc4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the XDG SEAT variable in the pam systemd module to minimize the risk of exploitation.