CVE-2019-14287

Published: Oct 17, 2019Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Affected (47)

Products: Sudo Project: Sudo · Fedoraproject: Fedora · Debian: Debian Linux · +4 more

Show all products

1 product

1 product

1 product

1 product

1 product

1 product

Element Software Management Node

Redhat

9 products

Enterprise Linux

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Openshift Container Platform

Virtualization

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sudo Project Sudo	Before 1.8.28

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Element Software Management Node	All versions

Configuration G

32 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Eus	Version 7.5
Redhat Enterprise Linux Eus	Version 7.6
Redhat Enterprise Linux Eus	Version 7.7
Redhat Enterprise Linux Eus	Version 8.1
Redhat Enterprise Linux Eus	Version 8.2
Redhat Enterprise Linux Eus	Version 8.4
Redhat Enterprise Linux Server	Version 5.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 6.5
Redhat Enterprise Linux Server Aus	Version 6.6
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Aus	Version 7.3
Redhat Enterprise Linux Server Aus	Version 7.4
Redhat Enterprise Linux Server Aus	Version 7.6
Redhat Enterprise Linux Server Aus	Version 7.7
Redhat Enterprise Linux Server Aus	Version 8.2
Redhat Enterprise Linux Server Aus	Version 8.4
Redhat Enterprise Linux Server Tus	Version 7.2
Redhat Enterprise Linux Server Tus	Version 7.3
Redhat Enterprise Linux Server Tus	Version 7.4
Redhat Enterprise Linux Server Tus	Version 7.6
Redhat Enterprise Linux Server Tus	Version 7.7
Redhat Enterprise Linux Server Tus	Version 8.2
Redhat Enterprise Linux Server Tus	Version 8.4
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0
Redhat Openshift Container Platform	Version 4.1
Redhat Virtualization	Version 4.2

Related CWEs

CWE-755

Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

References (74)

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00042.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00047.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2019/10/14/1

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/10/24/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/10/29/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/09/14/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHBA-2019:3248

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3197

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3204

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3205

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3209

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3219

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3278

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3694

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3754

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3755

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3895

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3916

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3941

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:4191

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0388

Source: cve@mitre.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2019/10/msg00022.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IP7SIOAVLSKJGMTIULX52VQUPTVSC43U/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPLAM57TPJQGKQMNG6RHFBLACD6K356N/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUVAOZBYUHZS56A5FQSCDVGXT7PW7FL2/

Source: cve@mitre.org

https://resources.whitesourcesoftware.com/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287

Source: cve@mitre.org

Third Party Advisory

https://seclists.org/bugtraq/2019/Oct/20

Source: cve@mitre.org

Issue TrackingMailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/Oct/21

Source: cve@mitre.org

Issue TrackingMailing ListThird Party Advisory

https://security.gentoo.org/glsa/202003-12

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20191017-0003/

Source: cve@mitre.org

Third Party Advisory

https://support.f5.com/csp/article/K53746212?utm_source=f5support&amp%3Butm_medium=RSS

Source: cve@mitre.org

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03976en_us

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4154-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4543

Source: cve@mitre.org

Third Party Advisory

https://www.openwall.com/lists/oss-security/2019/10/15/2

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://www.sudo.ws/alerts/minus_1_uid.html

Source: cve@mitre.org

ExploitVendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00042.html