high 7.8

CVE-2019-18634 in the critical feed json

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo pro…

published 2020-01-29 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-8357

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 19.3%; EPSS 19.3% chance of exploitation in 30 days, percentile 97%
public exploits: 2; Exploit-DB

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

Patch / fix

fixed in 1 distros 7

sudo_project sudo 1.8.26

debian ubuntu red hat suse opensuse alpine arch linux

sudo Debian 14, Debian 13, Debian 12 1.8.31-1

debian advisories DEBIAN-CVE-2019-18634

sudo Ubuntu 16.04 LTS 1.8.16-0ubuntu1.9
sudo Ubuntu 18.04 LTS 1.8.21p2-3ubuntu1.2
sudo Ubuntu Pro 14.04 LTS 1.8.9p5-1ubuntu1.5+esm3

ubuntu advisories UBUNTU-CVE-2019-18634

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

sudo RHEL 6 1.8.6p3-29.el6_10.3
sudo RHEL 7 1.8.23-4.el7_7.2
sudo RHEL 8 1.8.25p1-8.el8_1.1
sudo RHEL 8.0 E4S 1.8.25p1-4.el8_0.3

red hat advisories RHSA-2020:0726 RHSA-2020:0540 RHSA-2020:0509 RHSA-2020:0487

sudo SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.8.27-4.3.1
sudo SLES for SAP 15, SLES 15-LTSS, SLE Module for Basesystem 15 SP1 +3 more 1.8.22-4.9.1
sudo SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 1.8.10p3-10.26.1
sudo SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES 12 SP4 +8 more 1.8.20p2-3.17.1
sudo SLES for SAP 12 SP1, SLES 12 SP1-LTSS 1.8.10p3-2.32.1

suse advisories SUSE-SU-2020:0409-1 SUSE-SU-2020:0408-1 SUSE-SU-2020:0407-1 SUSE-SU-2020:0406-1 SUSE-SU-2020:0390-1

sudo openSUSE Tumbleweed 1.9.7p2-1.4
sudo openSUSE Leap 15.1 1.8.22-lp151.5.6.1

opensuse advisories openSUSE-SU-2024:11413-1 openSUSE-SU-2020:0244-1

sudo Alpine 3.10 1.8.27-r2
sudo Alpine 3.11 1.8.29-r2
sudo Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 1.8.31-r0
sudo Alpine 3.8 1.8.23-r4
sudo Alpine 3.9 1.8.25_p1-r3

alpine advisories ALPINE-CVE-2019-18634

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

sudo Arch Linux 1.8.31-1

arch linux advisories AVG-1093

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-18634 updated 2026-11-04 cvss 7.8

sudo: Stack based buffer overflow when pwfeedback is enabled

Red Hat Enterprise Linux BaseOS (v. 8) sudo 1.8.25p1-8.el8_1.1
fixed: vendor fix RHSA-2020:0487
Red Hat Enterprise Linux BaseOS E4S (v. 8.0) sudo 1.8.25p1-4.el8_0.3
fixed: vendor fix RHSA-2020:0509
Red Hat Enterprise Linux Client (v. 7) sudo 1.8.23-4.el7_7.2 Red Hat Enterprise Linux Client Optional (v. 7) sudo-devel 1.8.23-4.el7_7.2, sudo-debuginfo 1.8.23-4.el7_7.2 Red Hat Enterprise Linux ComputeNode (v. 7) sudo 1.8.23-4.el7_7.2 Red Hat Enterprise Linux ComputeNode Optional (v. 7) sudo-devel 1.8.23-4.el7_7.2, sudo-debuginfo 1.8.23-4.el7_7.2
fixed: vendor fix RHSA-2020:0540
Red Hat Enterprise Linux Desktop (v. 6) sudo 1.8.6p3-29.el6_10.3 Red Hat Enterprise Linux Desktop Optional (v. 6) sudo-devel 1.8.6p3-29.el6_10.3, sudo-debuginfo 1.8.6p3-29.el6_10.3 Red Hat Enterprise Linux HPC Node (v. 6) sudo 1.8.6p3-29.el6_10.3 Red Hat Enterprise Linux HPC Node Optional (v. 6) sudo-devel 1.8.6p3-29.el6_10.3, sudo-debuginfo 1.8.6p3-29.el6_10.3 Red Hat Enterprise Linux Server (v. 6) sudo 1.8.6p3-29.el6_10.3
fixed: vendor fix RHSA-2020:0726
Red Hat Enterprise Linux Server (v. 7) sudo 1.8.23-4.el7_7.2
fixed: vendor fix RHSA-2020:0540
Red Hat Enterprise Linux Server Optional (v. 6) sudo-devel 1.8.6p3-29.el6_10.3, sudo-debuginfo 1.8.6p3-29.el6_10.3
fixed: vendor fix RHSA-2020:0726
Red Hat Enterprise Linux Server Optional (v. 7) sudo-devel 1.8.23-4.el7_7.2, sudo-debuginfo 1.8.23-4.el7_7.2
fixed: vendor fix RHSA-2020:0540
Red Hat Enterprise Linux Workstation (v. 6) sudo 1.8.6p3-29.el6_10.3
fixed: vendor fix RHSA-2020:0726

show 4 more

Red Hat Enterprise Linux Workstation (v. 7) sudo 1.8.23-4.el7_7.2
fixed: vendor fix RHSA-2020:0540
Red Hat Enterprise Linux Workstation Optional (v. 6) sudo-devel 1.8.6p3-29.el6_10.3, sudo-debuginfo 1.8.6p3-29.el6_10.3
fixed: vendor fix RHSA-2020:0726
Red Hat Enterprise Linux Workstation Optional (v. 7) sudo-devel 1.8.23-4.el7_7.2, sudo-debuginfo 1.8.23-4.el7_7.2
fixed: vendor fix RHSA-2020:0540
Red Hat Enterprise Linux 5 sudo
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2020-01-29 Published
2020-02-04 First public exploit (EDB-47995)

Exploit prediction

19.28% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-48052 Sudo 1.8.25p - 'pwfeedback' Buffer Overflow local, 2020-02-06
EDB-47995 Sudo 1.8.25p - 'pwfeedback' Buffer Overflow (PoC) dos, 2020-02-04
sudo.ws https://www.sudo.ws/alerts/pwfeedback.html referenced PoC, tagged "exploit" by a source, unverified
openwall.com http://www.openwall.com/lists/oss-security/2020/02/05/5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.6	AV:L/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-787 Out-of-bounds Write

References

sudo.ws /alerts/pwfeedback.html
exploit, vendor-advisory
openwall.com /lists/oss-security/2020/02/05/5
mailing-list, exploit, third-party-advisory
debian.org /security/2020/dsa-4614
vendor-advisory, third-party-advisory
usn.ubuntu.com /4263-1/
vendor-advisory
usn.ubuntu.com /4263-2/
vendor-advisory
access.redhat.com /errata/RHSA-2020:0487
vendor-advisory
access.redhat.com /errata/RHSA-2020:0509
vendor-advisory
access.redhat.com /errata/RHSA-2020:0540
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2020-02/msg00029.html
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/
vendor-advisory
access.redhat.com /errata/RHSA-2020:0726
vendor-advisory
security.gentoo.org /glsa/202003-12
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/
vendor-advisory
sudo.ws /security.html
vendor-advisory
support.apple.com /kb/HT210919
third-party-advisory
seclists.org /bugtraq/2020/Jan/44
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2020/01/30/6
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2020/01/31/1
mailing-list, third-party-advisory
seclists.org /fulldisclosure/2020/Jan/40
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2020/02/msg00002.html
mailing-list, third-party-advisory
seclists.org /bugtraq/2020/Feb/3
mailing-list, third-party-advisory
seclists.org /bugtraq/2020/Feb/2
mailing-list, third-party-advisory
packetstormsecurity.com /files/156174/Slackware-Security-Advisory-sudo-Updates.html
third-party-advisory, vdb-entry
packetstormsecurity.com /files/156189/Sudo-1.8.25p-Buffer-Overflow.html
third-party-advisory, vdb-entry
openwall.com /lists/oss-security/2020/02/05/2
mailing-list, third-party-advisory
security.netapp.com /advisory/ntap-20200210-0001/

Sources

CVE List CVE-2019-18634
NVD CVE-2019-18634

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary