View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2019-3689 severity important: SUSE including 314 source package names (0.38.1:nfs-client-2.1.1-10.4.1, 0.38.1:nfs-kernel-server-2.1.1-10.4.1, …), 601 product×package rows across 173 product lines (Container ses/6/cephcsi/cephcsi, Container ses/6/rook/ceph, … (173 product lines)): Fixed 441, Known Affected 157, Known Not Affected 3.
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.