CVE-2019-19882

A flaw was found in shadow-utils. When compiled with --with-libpam, but without explicitly passing --disable-account-tools-setuid and suitable PAM configurations, a local user could obtain root access due to setuid being misconfigured. The highest threat from this vulnerability is to file confidentiality and integrity as well as system availability.

This issue only affects the shadow-utils package when compiled with the "with-libpam" option. The shadow-utils package, as shipped by Red Hat, is not compiled with that option and is therefore not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.