CVE-2019-14287 in the critical feed json
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules,…
published 2019-10-17 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-5514
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 63.8%
- EPSS 63.8% chance of exploitation in 30 days, percentile 99.2%
- public exploits
- 1
- Exploit-DB
Summary
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Patch / fix
- sudo_project sudo 1.8.28
- sudo Debian 14, Debian 13, Debian 12 1.8.27-1.1
debian advisories DEBIAN-CVE-2019-14287
- sudo Ubuntu 16.04 LTS 1.8.16-0ubuntu1.8
- sudo Ubuntu 18.04 LTS 1.8.21p2-3ubuntu1.1
- sudo Ubuntu Pro 14.04 LTS 1.8.9p5-1ubuntu1.5+esm2
ubuntu advisories UBUNTU-CVE-2019-14287
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- redhat-virtualization-host RHEL 7 4.2-20191022.0.el7_6
- redhat-release-virtualization-host RHEL 7 4.2-15.1.el7
- redhat-virtualization-host-image-update RHEL 7 4.2-20191022.0.el7_6
- redhat-release-virtualization-host-content RHEL 7 4.2-15.1.el7
- redhat-virtualization-host-image-update-placeholder RHEL 7 4.2-15.1.el7
- sudo RHEL 6 1.8.6p3-29.el6_10.2
- sudo RHEL 7 1.8.23-4.el7_7.1
- sudo RHEL 8 1.8.25p1-8.el8_1
red hat advisories RHBA-2019:3248RHSA-2019:4191RHSA-2020:0388RHSA-2019:3209RHSA-2019:3754RHSA-2019:3755
- sudo SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 1.7.6p2-0.30.5.1
- sudo SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 1.8.10p3-10.23.1
- sudo SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES 12 SP4 +8 more 1.8.20p2-3.14.1
- sudo SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 1.8.22-4.6.1
- sudo SLES for SAP 12 SP1, SLES 12 SP1-LTSS 1.8.10p3-2.28.1
suse advisories SUSE-SU-2019:14193-1SUSE-SU-2019:2668-1SUSE-SU-2019:2667-1SUSE-SU-2019:2666-1SUSE-SU-2019:2656-1
- sudo openSUSE Tumbleweed 1.9.7p2-1.4
- sudo openSUSE Leap 15.0 1.8.22-lp150.8.1
- sudo openSUSE Leap 15.1 1.8.22-lp151.5.3.1
opensuse advisories openSUSE-SU-2024:11413-1openSUSE-SU-2019:2333-1openSUSE-SU-2019:2316-1
- sudo Alpine 3.10 1.8.27-r1
- sudo Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 1.8.28-r0
- sudo Alpine 3.8 1.8.23-r3
- sudo Alpine 3.9 1.8.25_p1-r3
alpine advisories ALPINE-CVE-2019-14287
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- sudo Arch Linux 1.8.28-1
arch linux advisories AVG-1047
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-14287 updated cvss 7.0
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
-
Red Hat Enterprise Linux BaseOS (v. 8) sudo 1.8.25p1-8.el8_1fixed: vendor fix RHSA-2019:3694
-
Red Hat Enterprise Linux BaseOS E4S (v. 8.0) sudo 1.8.25p1-4.el8_0.2fixed: vendor fix RHSA-2020:0388
-
Red Hat Enterprise Linux Client (v. 7) sudo 1.8.23-4.el7_7.1 Red Hat Enterprise Linux Client Optional (v. 7) sudo-devel 1.8.23-4.el7_7.1, sudo-debuginfo 1.8.23-4.el7_7.1 Red Hat Enterprise Linux ComputeNode (v. 7) sudo 1.8.23-4.el7_7.1fixed: vendor fix RHSA-2019:3197
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) sudo 1.8.19p2-14.el7_5.1fixed: vendor fix RHSA-2019:3204
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) sudo 1.8.23-3.el7_6.1fixed: vendor fix RHSA-2019:3205
-
Red Hat Enterprise Linux ComputeNode Optional (v. 7) sudo-devel 1.8.23-4.el7_7.1, sudo-debuginfo 1.8.23-4.el7_7.1fixed: vendor fix RHSA-2019:3197
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) sudo-devel 1.8.19p2-14.el7_5.1, sudo-debuginfo 1.8.19p2-14.el7_5.1fixed: vendor fix RHSA-2019:3204
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) sudo-devel 1.8.23-3.el7_6.1, sudo-debuginfo 1.8.23-3.el7_6.1fixed: vendor fix RHSA-2019:3205
show 27 moreshow fewer
-
Red Hat Enterprise Linux Desktop (v. 6) sudo 1.8.6p3-29.el6_10.2 Red Hat Enterprise Linux Desktop Optional (v. 6) sudo-devel 1.8.6p3-29.el6_10.2, sudo-debuginfo 1.8.6p3-29.el6_10.2fixed: vendor fix RHSA-2019:3755
-
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) sudo 1.8.23-3.el7_6.1 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) sudo-devel 1.8.23-3.el7_6.1, sudo-debuginfo 1.8.23-3.el7_6.1fixed: vendor fix RHSA-2019:3205
-
Red Hat Enterprise Linux HPC Node (v. 6) sudo 1.8.6p3-29.el6_10.2 Red Hat Enterprise Linux HPC Node Optional (v. 6) sudo-devel 1.8.6p3-29.el6_10.2, sudo-debuginfo 1.8.6p3-29.el6_10.2fixed: vendor fix RHSA-2019:3755
-
Red Hat Enterprise Linux Server (v. 5 ELS) sudo 1.7.2p1-31.el5_11.1fixed: vendor fix RHSA-2019:4191
-
Red Hat Enterprise Linux Server (v. 6) sudo 1.8.6p3-29.el6_10.2fixed: vendor fix RHSA-2019:3755
-
Red Hat Enterprise Linux Server (v. 7) sudo 1.8.23-4.el7_7.1fixed: vendor fix RHSA-2019:3197
-
Red Hat Enterprise Linux Server AUS (v. 6.5) sudo 1.8.6p3-12.el6_5.2fixed: vendor fix RHSA-2019:3895
-
Red Hat Enterprise Linux Server AUS (v. 6.6) sudo 1.8.6p3-15.el6_6.2fixed: vendor fix RHSA-2019:3754
-
Red Hat Enterprise Linux Server AUS (v. 7.2) sudo 1.8.6p7-17.el7_2.2fixed: vendor fix RHSA-2019:3278
-
Red Hat Enterprise Linux Server AUS (v. 7.3) sudo 1.8.6p7-23.el7_3.2fixed: vendor fix RHSA-2019:3219
-
Red Hat Enterprise Linux Server AUS (v. 7.4) sudo 1.8.19p2-12.el7_4.1fixed: vendor fix RHSA-2019:3209
-
Red Hat Enterprise Linux Server E4S (v. 7.2) sudo 1.8.6p7-17.el7_2.2fixed: vendor fix RHSA-2019:3278
-
Red Hat Enterprise Linux Server E4S (v. 7.3) sudo 1.8.6p7-23.el7_3.2fixed: vendor fix RHSA-2019:3219
-
Red Hat Enterprise Linux Server E4S (v. 7.4) sudo 1.8.19p2-12.el7_4.1fixed: vendor fix RHSA-2019:3209
-
Red Hat Enterprise Linux Server EUS (v. 7.5) sudo 1.8.19p2-14.el7_5.1fixed: vendor fix RHSA-2019:3204
-
Red Hat Enterprise Linux Server EUS (v. 7.6) sudo 1.8.23-3.el7_6.1fixed: vendor fix RHSA-2019:3205
-
Red Hat Enterprise Linux Server Optional (v. 6) sudo-devel 1.8.6p3-29.el6_10.2, sudo-debuginfo 1.8.6p3-29.el6_10.2fixed: vendor fix RHSA-2019:3755
-
Red Hat Enterprise Linux Server Optional (v. 7) sudo-devel 1.8.23-4.el7_7.1, sudo-debuginfo 1.8.23-4.el7_7.1fixed: vendor fix RHSA-2019:3197
-
Red Hat Enterprise Linux Server Optional AUS (v. 6.5) sudo 1.8.6p3-12.el6_5.2fixed: vendor fix RHSA-2019:3895
-
Red Hat Enterprise Linux Server Optional AUS (v. 6.6) sudo-devel 1.8.6p3-15.el6_6.2, sudo-debuginfo 1.8.6p3-15.el6_6.2fixed: vendor fix RHSA-2019:3754
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.2) sudo-devel 1.8.6p7-17.el7_2.2, sudo-debuginfo 1.8.6p7-17.el7_2.2fixed: vendor fix RHSA-2019:3278
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.3) sudo-devel 1.8.6p7-23.el7_3.2, sudo-debuginfo 1.8.6p7-23.el7_3.2fixed: vendor fix RHSA-2019:3219
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) sudo-devel 1.8.19p2-12.el7_4.1, sudo-debuginfo 1.8.19p2-12.el7_4.1fixed: vendor fix RHSA-2019:3209
-
Red Hat Enterprise Linux Server Optional E4S (v. 7.2) sudo-devel 1.8.6p7-17.el7_2.2, sudo-debuginfo 1.8.6p7-17.el7_2.2fixed: vendor fix RHSA-2019:3278
-
Red Hat Enterprise Linux Server Optional E4S (v. 7.3) sudo-devel 1.8.6p7-23.el7_3.2, sudo-debuginfo 1.8.6p7-23.el7_3.2fixed: vendor fix RHSA-2019:3219
-
Red Hat Enterprise Linux Server Optional E4S (v. 7.4) sudo-devel 1.8.19p2-12.el7_4.1, sudo-debuginfo 1.8.19p2-12.el7_4.1fixed: vendor fix RHSA-2019:3209
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.5) sudo-devel 1.8.19p2-14.el7_5.1, sudo-debuginfo 1.8.19p2-14.el7_5.1fixed: vendor fix RHSA-2019:3204
14 more fixed in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (EDB-47502)
- Published
Exploit prediction
63.76% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-47502 sudo 1.8.27 - Security Bypass local, 2019-10-15
- openwall.com http://www.openwall.com/lists/oss-security/2019/10/14/1 referenced PoC, tagged "exploit" by a source, unverified
- sudo.ws https://www.sudo.ws/alerts/minus_1_uid.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-755 Improper Handling of Exceptional Conditions
References
-
openwall.com
/lists/oss-security/2019/10/15/2
mailing-list, patch, third-party-advisory
-
openwall.com
/lists/oss-security/2019/10/14/1
mailing-list, exploit, third-party-advisory
-
sudo.ws
/alerts/minus_1_uid.html
exploit, vendor-advisory
-
usn.ubuntu.com
/4154-1/
vendor-advisory, third-party-advisory
-
debian.org
/security/2019/dsa-4543
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-10/msg00042.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/IP7SIOAVLSKJGMTIULX52VQUPTVSC43U/
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-10/msg00047.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/TUVAOZBYUHZS56A5FQSCDVGXT7PW7FL2/
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:3197
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3205
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3204
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3209
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3219
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/NPLAM57TPJQGKQMNG6RHFBLACD6K356N/
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:3278
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3694
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3755
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3754
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3895
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3916
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHBA-2019:3248
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3941
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:4191
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0388
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/202003-12
vendor-advisory, third-party-advisory
-
seclists.org
/bugtraq/2019/Oct/21
mailing-list, issue-tracking, third-party-advisory
-
seclists.org
/bugtraq/2019/Oct/20
mailing-list, issue-tracking, third-party-advisory
-
packetstormsecurity.com
/files/154853/Slackware-Security-Advisory-sudo-Updates.html
third-party-advisory, vdb-entry
-
security.netapp.com
/advisory/ntap-20191017-0003/
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2019/10/msg00022.html
mailing-list, third-party-advisory
- support.f5.com /csp/article/K53746212?utm_source=f5support&%3Butm_medium=RSS
-
openwall.com
/lists/oss-security/2019/10/24/1
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2019/10/29/3
mailing-list, third-party-advisory
-
resources.whitesourcesoftware.com
/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287
third-party-advisory
-
support.hpe.com
/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03976en_us
third-party-advisory
-
openwall.com
/lists/oss-security/2021/09/14/2
mailing-list, third-party-advisory
Sources
- CVE List CVE-2019-14287
- NVD CVE-2019-14287
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.