What is CVE-2019-14287?

CVE-2019-14287 is a vulnerability in N/a. Published 2019-10-17.

Is CVE-2019-14287 known to be exploited?

175 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in N/a

CVE-2019-14287

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows b…

EPSS: 0.858 (99.4th percentile) — read the EPSS interpretation.

Affected products

N/a — versions n/a

Public proof-of-concept exploits

References

[oss-security] 20191014 Sudo: CVE-2019-14287 (mailing-list, x_refsource_MLIST)
USN-4154-1 (vendor-advisory, x_refsource_UBUNTU)
DSA-4543 (vendor-advisory, x_refsource_DEBIAN)
20191015 [SECURITY] [DSA 4543-1] sudo security update (mailing-list, x_refsource_BUGTRAQ)
20191015 [slackware-security] sudo (SSA:2019-287-01) (mailing-list, x_refsource_BUGTRAQ)
openSUSE-SU-2019:2316 (vendor-advisory, x_refsource_SUSE)
packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.h… (x_refsource_MISC)
FEDORA-2019-9cb221f2be (vendor-advisory, x_refsource_FEDORA)
www.sudo.ws/alerts/minus_1_uid.html (x_refsource_CONFIRM)
openSUSE-SU-2019:2333 (vendor-advisory, x_refsource_SUSE)

Frequently asked questions

What is CVE-2019-14287?: CVE-2019-14287 is a vulnerability in N/a. Published 2019-10-17.
Is CVE-2019-14287 known to be exploited?: 175 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.