High severity7.8NVD Advisory· Published Jan 9, 2020· Updated Jun 17, 2026

CVE-2019-20373

Description

LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script.

Affected products

Ltsp/ldm2 versions
cpe:2.3:a:ltsp:ldm:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ltsp:ldm:*:*:*:*:*:*:*:*range: <=2.18.06
- (no CPE)range: <=2.18.06
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
LTSP/LDMdescription

Patches

Vulnerability mechanics

References

git.launchpad.net/~ltsp-upstream/ltsp/+git/ldm/commit/nvdPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2020/01/msg00007.htmlnvdMailing ListPatchThird Party Advisory
www.debian.org/security/2020/dsa-4601nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000