In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a…
Priority MEDIUM 52CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.
Summary
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
Why it matters now
EPSS 0.19276 97th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* | 1.7.1 to before 1.8.26 | Vulnerable | Sudo project |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* Versions 1.7.1 to before 1.8.26 Vulnerable ·Sudo project
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
Red Hat 4 advisories
- RHSA-2020:0726 Released 2020-03-05 · Red Hat rating Importantsudo security update
- Red Hat Enterprise Linux Desktop (v. 6) sudo-1.8.6p3-29.el6_10.3
- Red Hat Enterprise Linux Desktop Optional (v. 6) sudo-devel-1.8.6p3-29.el6_10.3
- Red Hat Enterprise Linux HPC Node (v. 6) sudo-1.8.6p3-29.el6_10.3
- Red Hat Enterprise Linux HPC Node Optional (v. 6) sudo-devel-1.8.6p3-29.el6_10.3
- Red Hat Enterprise Linux Server (v. 6) sudo-1.8.6p3-29.el6_10.3
- Red Hat Enterprise Linux Server Optional (v. 6) sudo-devel-1.8.6p3-29.el6_10.3, sudo-devel-1.8.6p3-29.el6_10.3.ppc
- Red Hat Enterprise Linux Workstation (v. 6) sudo-1.8.6p3-29.el6_10.3
- Red Hat Enterprise Linux Workstation Optional (v. 6) sudo-devel-1.8.6p3-29.el6_10.3
- RHSA-2020:0540 Released 2020-02-19 · Red Hat rating Importantsudo security update
- Red Hat Enterprise Linux Client (v. 7) sudo-1.8.23-4.el7_7.2
- Red Hat Enterprise Linux Client Optional (v. 7) sudo-devel-1.8.23-4.el7_7.2
- Red Hat Enterprise Linux ComputeNode (v. 7) sudo-1.8.23-4.el7_7.2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) sudo-devel-1.8.23-4.el7_7.2
- Red Hat Enterprise Linux Server (v. 7) sudo-1.8.23-4.el7_7.2
- Red Hat Enterprise Linux Server Optional (v. 7) sudo-devel-1.8.23-4.el7_7.2, sudo-devel-1.8.23-4.el7_7.2.ppc
- Red Hat Enterprise Linux Workstation (v. 7) sudo-1.8.23-4.el7_7.2
- Red Hat Enterprise Linux Workstation Optional (v. 7) sudo-devel-1.8.23-4.el7_7.2
- RHSA-2020:0487 Released 2020-02-14 · Red Hat rating Importantsudo security update
- Red Hat Enterprise Linux BaseOS (v. 8) sudo-1.8.25p1-8.el8_1.1
Show 1 more Red Hat advisories
- RHSA-2020:0509 Released 2020-02-14 · Red Hat rating Importantsudo security update
- Red Hat Enterprise Linux BaseOS E4S (v. 8.0) sudo-1.8.25p1-4.el8_0.3
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:0487 |
| Red Hat Enterprise Linux BaseOS E4S (v. 8.0) | Fixed | RHSA-2020:0509 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:0540 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:0540 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:0540 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:0540 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2020:0726 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2020:0726 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2020:0726 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2020:0726 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2020:0726 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:0540 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2020:0726 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:0540 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2020:0726 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:0540 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2020:0726 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:0540 |
Not affected: 1 product
- Red Hat Enterprise Linux 5
Timeline
- 2026-10-02 Threatist record created from CVE-2019-18634
- 2026-10-03 Alias added: GHSA-rjv5-9w4p-4jrw
References
Exploit 2
Advisory 23
- https://support.apple.com/kb/HT210919
- 20200129 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra
- https://www.sudo.ws/security.html
- [oss-security] 20200130 CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled
- [oss-security] 20200131 Re: CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled
- 20200131 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra
- DSA-4614
- [debian-lts-announce] 20200201 [SECURITY] [DLA 2094-1] sudo security update
- 20200203 [slackware-security] sudo (SSA:2020-031-01)
- 20200203 [SECURITY] [DSA 4614-1] sudo security update
- http://packetstormsecurity.com/files/156174/Slackware-Security-Advisory-sudo-Updates.html
- http://packetstormsecurity.com/files/156189/Sudo-1.8.25p-Buffer-Overflow.html
- [oss-security] 20200205 Re: CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled
- USN-4263-1
- USN-4263-2
- RHSA-2020:0487
- RHSA-2020:0509
- RHSA-2020:0540
- openSUSE-SU-2020:0244
- FEDORA-2020-8b563bc5f4
- RHSA-2020:0726
- GLSA-202003-12
- FEDORA-2020-7c1b270959
Sources
- CVE-2019-18634 · CVE Program
- CVE-2019-18634 · NVD
- FIRST EPSS
- GHSA-rjv5-9w4p-4jrw · GitHub Advisory Database · CC BY 4.0
- CVE-2019-18634 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences