CVE-2019-20044
Fixed in a distro release EPSS <1%
In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().
Products: zsh, fedoraproject fedora, debian_linux, apple ipados, apple iphone_os, apple mac_os_x, apple tvos, apple watchos
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | zsh-html | 5.5.1-6.el8_1.2 |
| Alpine 3.12 | zsh | 5.8-r0 |
| Alpine 3.13 | zsh | 5.8-r0 |
| Alpine 3.14 | zsh | 5.8-r0 |
| Alpine 3.15 | zsh | 5.8-r0 |
| Alpine 3.16 | zsh | 5.8-r0 |
| Alpine 3.17 | zsh | 5.8-r0 |
| Alpine 3.18 | zsh | 5.8-r0 |
| Alpine 3.19 | zsh | 5.8-r0 |
| Alpine 3.20 | zsh | 5.8-r0 |
| Alpine 3.21 | zsh | 5.8-r0 |
| Alpine 3.22 | zsh | 5.8-r0 |
| Alpine 3.23 | zsh | 5.8-r0 |
| Alpine 3.24 | zsh | 5.8-r0 |
| Amazon Linux 2 | zsh | 5.7.1-6.amzn2.0.1 |
| Amazon Linux 2 | zsh-html | 5.7.1-6.amzn2.0.1 |
| Debian 12 | zsh | 5.8-1 |
| Debian 13 | zsh | 5.8-1 |
| Debian 14 | zsh | 5.8-1 |
| Debian 8 | zsh | 5.0.7-5+deb8u1 |
| Debian 9 | zsh | 5.3.1-4+deb9u1 |
| Red Hat Enterprise Linux 6 | zsh | 0:4.3.11-11.el6_10 |
| Red Hat Enterprise Linux 6 | zsh-debuginfo | 0:4.3.11-11.el6_10 |
| Red Hat Enterprise Linux 6 | zsh-html | 0:4.3.11-11.el6_10 |
| Red Hat Enterprise Linux 7 | zsh | 0:5.0.2-34.el7_7.2 |
| Red Hat Enterprise Linux 7 | zsh-debuginfo | 0:5.0.2-34.el7_7.2 |
| Red Hat Enterprise Linux 7 | zsh-html | 0:5.0.2-34.el7_7.2 |
| Red Hat Enterprise Linux 8 | zsh | 0:5.5.1-6.el8_1.2 |
| Red Hat Enterprise Linux 8 | zsh-debuginfo | 0:5.5.1-6.el8_1.2 |
| Red Hat Enterprise Linux 8 | zsh-debugsource | 0:5.5.1-6.el8_1.2 |
| Red Hat Enterprise Linux 8 | zsh-html | 0:5.5.1-6.el8_1.2 |
| Red Hat rhel e4s 8.0 | zsh | 0:5.5.1-6.el8_0.2 |
| Red Hat rhel e4s 8.0 | zsh-debuginfo | 0:5.5.1-6.el8_0.2 |
| Red Hat rhel e4s 8.0 | zsh-debugsource | 0:5.5.1-6.el8_0.2 |
| Red Hat rhel e4s 8.0 | zsh-html | 0:5.5.1-6.el8_0.2 |
| Rocky Linux 8 | zsh | 0:5.5.1-6.el8_1.2 |
| SUSE Enterprise Storage 6 | zsh | 5.6-7.5.1 |
| SUSE Enterprise Storage 7 | zsh | 5.6-7.5.1 |
| SUSE HPE Helion OpenStack 8 | zsh | 5.0.5-6.19.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | zsh | 5.6-3.11.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | zsh | 5.6-3.11.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | zsh | 4.3.6-67.9.8.1 |
| SUSE Linux Enterprise Real Time 15 SP2 | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | zsh | 4.3.6-67.9.8.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | zsh | 5.0.5-6.19.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | zsh | 5.0.5-6.19.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | zsh | 5.0.5-6.19.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | zsh | 5.0.5-6.19.1 |
| SUSE Linux Enterprise Server 12 SP5 | zsh | 5.0.5-6.19.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise Server 15 SP2-BCL | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise Server 15-LTSS | zsh | 5.6-3.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | zsh | 5.0.5-6.19.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | zsh | 5.0.5-6.19.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | zsh | 5.0.5-6.19.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | zsh | 5.6-3.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | zsh | 5.6-7.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | zsh | 5.6-7.5.1 |
| SUSE Manager Proxy 4.1 | zsh | 5.6-7.5.1 |
| SUSE Manager Retail Branch Server 4.1 | zsh | 5.6-7.5.1 |
| SUSE Manager Server 4.1 | zsh | 5.6-7.5.1 |
| SUSE OpenStack Cloud 8 | zsh | 5.0.5-6.19.1 |
| SUSE OpenStack Cloud 9 | zsh | 5.0.5-6.19.1 |
| SUSE OpenStack Cloud Crowbar 8 | zsh | 5.0.5-6.19.1 |
| SUSE OpenStack Cloud Crowbar 9 | zsh | 5.0.5-6.19.1 |
| Ubuntu 18.04 LTS | zsh | 5.4.2-3ubuntu3.2 |
| Ubuntu 20.04 LTS | zsh | 5.8-3ubuntu1.1 |
| Ubuntu 22.04 LTS | zsh | no fix |
| Ubuntu Pro 16.04 LTS | zsh | 5.1.1-1ubuntu2.3+esm1 |
| openSUSE Leap 15.3 | zsh | 5.6-7.5.1 |
| openSUSE Tumbleweed | zsh | 5.8-7.7 |