CVE-2019-14287
Fixed in a distro release EPSS 64%
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Products: sudo_project sudo, fedoraproject fedora, debian_linux, opensuse leap, canonical ubuntu_linux, netapp element_software_management_node, redhat openshift_container_platform, redhat virtualization, redhat enterprise_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | sudo | 1.8.27-r1 |
| Alpine 3.11 | sudo | 1.8.28-r0 |
| Alpine 3.12 | sudo | 1.8.28-r0 |
| Alpine 3.13 | sudo | 1.8.28-r0 |
| Alpine 3.14 | sudo | 1.8.28-r0 |
| Alpine 3.15 | sudo | 1.8.28-r0 |
| Alpine 3.8 | sudo | 1.8.23-r3 |
| Alpine 3.9 | sudo | 1.8.25_p1-r3 |
| Amazon Linux 2 | sudo | 1.8.23-4.amzn2.0.1 |
| Amazon Linux 2 | sudo-devel | 1.8.23-4.amzn2.0.1 |
| Arch Linux | sudo | 1.8.28-1 |
| Debian 10 | sudo | 1.8.27-1+deb10u1 |
| Debian 12 | sudo | 1.8.27-1.1 |
| Debian 13 | sudo | 1.8.27-1.1 |
| Debian 14 | sudo | 1.8.27-1.1 |
| Debian 8 | sudo | 1.8.10p3-1+deb8u6 |
| Debian 9 | sudo | 1.8.19p1-2.1+deb9u1 |
| Red Hat Enterprise Linux 6 | sudo | 0:1.8.6p3-29.el6_10.2 |
| Red Hat Enterprise Linux 6 | sudo-debuginfo | 0:1.8.6p3-29.el6_10.2 |
| Red Hat Enterprise Linux 6 | sudo-devel | 0:1.8.6p3-29.el6_10.2 |
| Red Hat Enterprise Linux 7 | redhat-release-virtualization-host | 0:4.2-15.1.el7 |
| Red Hat Enterprise Linux 7 | redhat-release-virtualization-host-content | 0:4.2-15.1.el7 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host | 0:4.2-20191022.0.el7_6 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update | 0:4.2-20191022.0.el7_6 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update-placeholder | 0:4.2-15.1.el7 |
| Red Hat Enterprise Linux 7 | sudo | 0:1.8.23-4.el7_7.1 |
| Red Hat Enterprise Linux 7 | sudo-debuginfo | 0:1.8.23-4.el7_7.1 |
| Red Hat Enterprise Linux 7 | sudo-devel | 0:1.8.23-4.el7_7.1 |
| Red Hat Enterprise Linux 8 | sudo | 0:1.8.25p1-8.el8_1 |
| Red Hat Enterprise Linux 8 | sudo-debuginfo | 0:1.8.25p1-8.el8_1 |
| Red Hat Enterprise Linux 8 | sudo-debugsource | 0:1.8.25p1-8.el8_1 |
| Red Hat rhel aus 6.5 | sudo | 0:1.8.6p3-12.el6_5.2 |
| Red Hat rhel aus 6.5 | sudo-debuginfo | 0:1.8.6p3-12.el6_5.2 |
| Red Hat rhel aus 6.5 | sudo-devel | 0:1.8.6p3-12.el6_5.2 |
| Red Hat rhel aus 6.6 | sudo | 0:1.8.6p3-15.el6_6.2 |
| Red Hat rhel aus 6.6 | sudo-debuginfo | 0:1.8.6p3-15.el6_6.2 |
| Red Hat rhel aus 6.6 | sudo-devel | 0:1.8.6p3-15.el6_6.2 |
| Red Hat rhel aus 7.2 | sudo | 0:1.8.6p7-17.el7_2.2 |
| Red Hat rhel aus 7.2 | sudo-debuginfo | 0:1.8.6p7-17.el7_2.2 |
| Red Hat rhel aus 7.2 | sudo-devel | 0:1.8.6p7-17.el7_2.2 |
| Red Hat rhel aus 7.3 | sudo | 0:1.8.6p7-23.el7_3.2 |
| Red Hat rhel aus 7.3 | sudo-debuginfo | 0:1.8.6p7-23.el7_3.2 |
| Red Hat rhel aus 7.3 | sudo-devel | 0:1.8.6p7-23.el7_3.2 |
| Red Hat rhel aus 7.4 | sudo | 0:1.8.19p2-12.el7_4.1 |
| Red Hat rhel aus 7.4 | sudo-debuginfo | 0:1.8.19p2-12.el7_4.1 |
| Red Hat rhel aus 7.4 | sudo-devel | 0:1.8.19p2-12.el7_4.1 |
| Red Hat rhel e4s 7.2 | sudo | 0:1.8.6p7-17.el7_2.2 |
| Red Hat rhel e4s 7.2 | sudo-debuginfo | 0:1.8.6p7-17.el7_2.2 |
| Red Hat rhel e4s 7.2 | sudo-devel | 0:1.8.6p7-17.el7_2.2 |
| Red Hat rhel e4s 7.3 | sudo | 0:1.8.6p7-23.el7_3.2 |
| Red Hat rhel e4s 7.3 | sudo-debuginfo | 0:1.8.6p7-23.el7_3.2 |
| Red Hat rhel e4s 7.3 | sudo-devel | 0:1.8.6p7-23.el7_3.2 |
| Red Hat rhel e4s 7.4 | sudo | 0:1.8.19p2-12.el7_4.1 |
| Red Hat rhel e4s 7.4 | sudo-debuginfo | 0:1.8.19p2-12.el7_4.1 |
| Red Hat rhel e4s 7.4 | sudo-devel | 0:1.8.19p2-12.el7_4.1 |
| Red Hat rhel e4s 8.0 | sudo | 0:1.8.25p1-4.el8_0.2 |
| Red Hat rhel e4s 8.0 | sudo-debuginfo | 0:1.8.25p1-4.el8_0.2 |
| Red Hat rhel e4s 8.0 | sudo-debugsource | 0:1.8.25p1-4.el8_0.2 |
| Red Hat rhel els 5 | sudo | 0:1.7.2p1-31.el5_11.1 |
| Red Hat rhel els 5 | sudo-debuginfo | 0:1.7.2p1-31.el5_11.1 |
| Red Hat rhel eus 7.5 | sudo | 0:1.8.19p2-14.el7_5.1 |
| Red Hat rhel eus 7.5 | sudo-debuginfo | 0:1.8.19p2-14.el7_5.1 |
| Red Hat rhel eus 7.5 | sudo-devel | 0:1.8.19p2-14.el7_5.1 |
| Red Hat rhel eus 7.6 | sudo | 0:1.8.23-3.el7_6.1 |
| Red Hat rhel eus 7.6 | sudo-debuginfo | 0:1.8.23-3.el7_6.1 |
| Red Hat rhel eus 7.6 | sudo-devel | 0:1.8.23-3.el7_6.1 |
| Red Hat rhel tus 7.2 | sudo | 0:1.8.6p7-17.el7_2.2 |
| Red Hat rhel tus 7.2 | sudo-debuginfo | 0:1.8.6p7-17.el7_2.2 |
| Red Hat rhel tus 7.2 | sudo-devel | 0:1.8.6p7-17.el7_2.2 |
| Red Hat rhel tus 7.3 | sudo | 0:1.8.6p7-23.el7_3.2 |
| Red Hat rhel tus 7.3 | sudo-debuginfo | 0:1.8.6p7-23.el7_3.2 |
| Red Hat rhel tus 7.3 | sudo-devel | 0:1.8.6p7-23.el7_3.2 |
| Red Hat rhel tus 7.4 | sudo | 0:1.8.19p2-12.el7_4.1 |
| Red Hat rhel tus 7.4 | sudo-debuginfo | 0:1.8.19p2-12.el7_4.1 |
| Red Hat rhel tus 7.4 | sudo-devel | 0:1.8.19p2-12.el7_4.1 |
| SUSE Enterprise Storage 4 | sudo | 1.8.10p3-10.23.1 |
| SUSE Enterprise Storage 5 | sudo | 1.8.20p2-3.14.1 |
| SUSE HPE Helion OpenStack 8 | sudo | 1.8.20p2-3.14.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | sudo | 1.8.20p2-3.14.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | sudo | 1.8.22-4.6.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | sudo | 1.8.22-4.6.1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | sudo | 1.7.6p2-0.30.5.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | sudo | 1.7.6p2-0.30.5.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | sudo | 1.8.10p3-2.28.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | sudo | 1.8.10p3-10.23.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | sudo | 1.8.10p3-10.23.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | sudo | 1.8.20p2-3.14.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | sudo | 1.8.20p2-3.14.1 |
| SUSE Linux Enterprise Server 12 SP4 | sudo | 1.8.20p2-3.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | sudo | 1.8.10p3-2.28.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | sudo | 1.8.10p3-10.23.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | sudo | 1.8.20p2-3.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | sudo | 1.8.20p2-3.14.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | sudo | 1.8.20p2-3.14.1 |
| SUSE OpenStack Cloud 7 | sudo | 1.8.10p3-10.23.1 |
| SUSE OpenStack Cloud 8 | sudo | 1.8.20p2-3.14.1 |
| SUSE OpenStack Cloud Crowbar 8 | sudo | 1.8.20p2-3.14.1 |
| Ubuntu 16.04 LTS | sudo | 1.8.16-0ubuntu1.8 |
| Ubuntu 18.04 LTS | sudo | 1.8.21p2-3ubuntu1.1 |
| Ubuntu Pro 14.04 LTS | sudo | 1.8.9p5-1ubuntu1.5+esm2 |
| openSUSE Leap 15.0 | sudo | 1.8.22-lp150.8.1 |
| openSUSE Leap 15.1 | sudo | 1.8.22-lp151.5.3.1 |
| openSUSE Tumbleweed | sudo | 1.9.7p2-1.4 |