In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 1 advisory
- RHSA-2020:1804 Released 2020-04-28 · Red Hat rating Moderatesudo security, bug fix, and enhancement update
- Red Hat Enterprise Linux BaseOS (v. 8) sudo-1.8.29-5.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:1804 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-19232
- 2026-10-03 Alias added: GHSA-g292-5fg6-fchh
References
Advisory 4
Other 14
- https://security.netapp.com/advisory/ntap-20200103-0004/
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979
- https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k20-0001.html
- https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1018-5506
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58103
- https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-19232
- https://access.redhat.com/security/cve/cve-2019-19232
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs76870
- https://support.apple.com/kb/HT211100
- 20200324 APPLE-SA-2020-03-24-2 macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sierra
- https://support.apple.com/en-gb/HT211100
- https://www.tenable.com/plugins/nessus/133936
- https://www.oracle.com/security-alerts/bulletinapr2020.html
More Sudo vulnerabilities
- TI-2019-13863 In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the !… CVSS 3.1HIGH 7.5
Sources
- CVE-2019-19232 · CVE Program
- CVE-2019-19232 · NVD
- FIRST EPSS
- GHSA-g292-5fg6-fchh · GitHub Advisory Database · CC BY 4.0
- CVE-2019-19232 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences