A debian-lan-config security update has been released for both Debian GNU/Linux 9 and 10. It was discovered that debian-lan-config, a FAI config space for the Debian-LAN system, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other user principals.