Every CVE Search/ Get API key

CVE-2019-14287

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain...

8.8 HighPublic exploitFix available

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u #$((0xffffffff))" command.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

63.8%Up 37.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u #$((0xffffffff))" command.

Record
CVE-2019-14287
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness
CWE-755
Updated
2026-11-02
CVE List No score

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u #$((0xffffffff))" command.

Record
CVE-2019-14287
Updated
2026-11-02
EUVDEUVD-2019-5514 No score

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u #$((0xffffffff))" command.

Record
EUVD-2019-5514
Updated
2026-11-03
GitHub AdvisoriesGHSA-33h3-qhjg-4qmf 8.8

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain...

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u #$((0xffffffff))" command.

Record
GHSA-33h3-qhjg-4qmf
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-755
Updated
2026-11-02
OSVALPINE-CVE-2019-14287 8.8

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u #$((0xffffffff))" command.

Record
ALPINE-CVE-2019-14287
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2019-14287 8.8

CVE-2019-14287 does not affect BellSoft software

Record
BELL-CVE-2019-14287
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 26 moreShow less
OSV 8.8

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u #$((0xffffffff))" command.

Record
CVE-2019-14287
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-14287 8.8

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u #$((0xffffffff))" command.

Record
DEBIAN-CVE-2019-14287
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHBA-2019:3248 6.4

Red Hat Bug Fix Advisory: redhat-virtualization-host security update

Record
RHBA-2019:3248
CVSS 3.0
6.4 MediumCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3197 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:3197
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3204 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:3204
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3205 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:3205
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3209 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:3209
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3219 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:3219
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3278 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:3278
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3694 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:3694
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3754 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:3754
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3755 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:3755
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3895 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:3895
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:4191 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2019:4191
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:0388 7.0

Red Hat Security Advisory: sudo security update

Record
RHSA-2020:0388
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-14287 8.8

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u #$((0xffffffff))" command.

Record
UBUNTU-CVE-2019-14287
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0298 No score

Updated sudo packages fix security vulnerability

The updated packages fix a security vulnerability:

Potential bypass of Runas user restrictions. (CVE-2019-14287)

Record
MGASA-2019-0298
Updated
2026-11-02
OSVopenSUSE-SU-2019:2316-1 No score

Security update for sudo

This update for sudo fixes the following issue:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2316-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2333-1 No score

Security update for sudo

This update for sudo fixes the following issue:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2333-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11413-1 No score

sudo-1.9.7p2-1.4 on GA media

These are all security issues fixed in the sudo-1.9.7p2-1.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11413-1
Updated
2026-11-02
OSVSUSE-SU-2019:14193-1 No score

Security update for sudo

This update for sudo fixes the following issues:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).
Record
SUSE-SU-2019:14193-1
Updated
2026-11-02
OSVSUSE-SU-2019:2656-1 No score

Security update for sudo

This update for sudo fixes the following issue:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).
Record
SUSE-SU-2019:2656-1
Updated
2026-11-02
OSVSUSE-SU-2019:2666-1 No score

Security update for sudo

This update for sudo fixes the following issues:

Security issue fixed:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).
Record
SUSE-SU-2019:2666-1
Updated
2026-11-02
OSVSUSE-SU-2019:2667-1 No score

Security update for sudo

This update for sudo fixes the following issues:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).
Record
SUSE-SU-2019:2667-1
Updated
2026-11-02
OSVSUSE-SU-2019:2668-1 No score

Security update for sudo

This update for sudo provides the following fix:

Security issue fixed:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).

Other issues fixed:

  • Cache resolved group names as calling getgrgid() is expensive and on systems connected to AD with many users, groups or sudo rules it causes sudo to take a long time to run (bsc#1068003).
  • Disable insults by default at build time. For new installations this was done via sudoers file, but when upgrading from previous versions it would accidentally be enabled (bsc#1053911).
  • Enable support for zlib compressed I/O logs (bsc#1058297).
Record
SUSE-SU-2019:2668-1
Updated
2026-11-02
OSVUSN-4154-1 No score

sudo vulnerability

Joe Vennix discovered that Sudo incorrectly handled certain user IDs. An attacker could potentially exploit this to execute arbitrary commands as the root user.

Record
USN-4154-1
Updated
2026-11-02

Affected products

Show 3 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
sudo
Alpine:v3.10
 before 1.8.27-r1
1.8.27-r1
sudo
Alpine:v3.11
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.12
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.13
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.14
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.15
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.16
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.17
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.18
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.19
 before 1.8.28-r0
1.8.28-r0
Show 124 moreShow less
Affected packages
PackageAffectedFixed
sudo
Alpine:v3.20
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.21
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.22
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.23
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.24
 before 1.8.28-r0
1.8.28-r0
sudo
Alpine:v3.8
 before 1.8.23-r3
1.8.23-r3
sudo
Alpine:v3.9
 before 1.8.25_p1-r3
1.8.25_p1-r3
sudo
Debian:12
 before 1.8.27-1.1
1.8.27-1.1
sudo
Debian:13
 before 1.8.27-1.1
1.8.27-1.1
sudo
Debian:14
 before 1.8.27-1.1
1.8.27-1.1
sudo
Debian:8
 before 1.8.10p3-1+deb8u6, plus listed versions
1.8.10p3-1+deb8u21.8.10p3-1+deb8u31.8.10p3-1+deb8u41.8.10p3-1+deb8u5
1.8.10p3-1+deb8u6
sudo
Debian:9
 before 1.8.19p1-2.1+deb9u1, plus listed versions
1.8.19p1-2.1
1.8.19p1-2.1+deb9u1
sudo
Debian:10
 before 1.8.27-1+deb10u1, plus listed versions
1.8.27-1
1.8.27-1+deb10u1
sudo
Mageia:7
 before 1.8.28-1.mga7
1.8.28-1.mga7
redhat-release-virtualization-host
Red Hat:enterprise_linux:7::hypervisor
From an advisory covering 2 CVEs
 before 0:4.2-15.1.el7
0:4.2-15.1.el7
redhat-release-virtualization-host-content
Red Hat:enterprise_linux:7::hypervisor
From an advisory covering 2 CVEs
 before 0:4.2-15.1.el7
0:4.2-15.1.el7
redhat-virtualization-host
Red Hat:enterprise_linux:7::hypervisor
From an advisory covering 2 CVEs
 before 0:4.2-20191022.0.el7_6
0:4.2-20191022.0.el7_6
redhat-virtualization-host-image-update
Red Hat:enterprise_linux:7::hypervisor
From an advisory covering 2 CVEs
 before 0:4.2-20191022.0.el7_6
0:4.2-20191022.0.el7_6
redhat-virtualization-host-image-update-placeholder
Red Hat:enterprise_linux:7::hypervisor
From an advisory covering 2 CVEs
 before 0:4.2-15.1.el7
0:4.2-15.1.el7
sudo
Red Hat:enterprise_linux:7::client
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo-devel
Red Hat:enterprise_linux:7::client
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo
Red Hat:enterprise_linux:7::server
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo-devel
Red Hat:enterprise_linux:7::server
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.23-4.el7_7.1
0:1.8.23-4.el7_7.1
sudo
Red Hat:rhel_eus:7.5::computenode
 before 0:1.8.19p2-14.el7_5.1
0:1.8.19p2-14.el7_5.1
sudo-debuginfo
Red Hat:rhel_eus:7.5::computenode
 before 0:1.8.19p2-14.el7_5.1
0:1.8.19p2-14.el7_5.1
sudo-devel
Red Hat:rhel_eus:7.5::computenode
 before 0:1.8.19p2-14.el7_5.1
0:1.8.19p2-14.el7_5.1
sudo
Red Hat:rhel_eus:7.5::server
 before 0:1.8.19p2-14.el7_5.1
0:1.8.19p2-14.el7_5.1
sudo-debuginfo
Red Hat:rhel_eus:7.5::server
 before 0:1.8.19p2-14.el7_5.1
0:1.8.19p2-14.el7_5.1
sudo-devel
Red Hat:rhel_eus:7.5::server
 before 0:1.8.19p2-14.el7_5.1
0:1.8.19p2-14.el7_5.1
sudo
Red Hat:rhel_eus:7.6::computenode
 before 0:1.8.23-3.el7_6.1
0:1.8.23-3.el7_6.1
sudo-debuginfo
Red Hat:rhel_eus:7.6::computenode
 before 0:1.8.23-3.el7_6.1
0:1.8.23-3.el7_6.1
sudo-devel
Red Hat:rhel_eus:7.6::computenode
 before 0:1.8.23-3.el7_6.1
0:1.8.23-3.el7_6.1
sudo
Red Hat:rhel_eus:7.6::server
 before 0:1.8.23-3.el7_6.1
0:1.8.23-3.el7_6.1
sudo-debuginfo
Red Hat:rhel_eus:7.6::server
 before 0:1.8.23-3.el7_6.1
0:1.8.23-3.el7_6.1
sudo-devel
Red Hat:rhel_eus:7.6::server
 before 0:1.8.23-3.el7_6.1
0:1.8.23-3.el7_6.1
sudo
Red Hat:rhel_aus:7.4::server
 before 0:1.8.19p2-12.el7_4.1
0:1.8.19p2-12.el7_4.1
sudo-debuginfo
Red Hat:rhel_aus:7.4::server
 before 0:1.8.19p2-12.el7_4.1
0:1.8.19p2-12.el7_4.1
sudo
Red Hat:rhel_e4s:7.4::server
 before 0:1.8.19p2-12.el7_4.1
0:1.8.19p2-12.el7_4.1
sudo-debuginfo
Red Hat:rhel_e4s:7.4::server
 before 0:1.8.19p2-12.el7_4.1
0:1.8.19p2-12.el7_4.1
sudo
Red Hat:rhel_tus:7.4::server
 before 0:1.8.19p2-12.el7_4.1
0:1.8.19p2-12.el7_4.1
sudo-debuginfo
Red Hat:rhel_tus:7.4::server
 before 0:1.8.19p2-12.el7_4.1
0:1.8.19p2-12.el7_4.1
sudo-devel
Red Hat:rhel_aus:7.4::server
 before 0:1.8.19p2-12.el7_4.1
0:1.8.19p2-12.el7_4.1
sudo-devel
Red Hat:rhel_e4s:7.4::server
 before 0:1.8.19p2-12.el7_4.1
0:1.8.19p2-12.el7_4.1
sudo-devel
Red Hat:rhel_tus:7.4::server
 before 0:1.8.19p2-12.el7_4.1
0:1.8.19p2-12.el7_4.1
sudo
Red Hat:rhel_aus:7.3::server
 before 0:1.8.6p7-23.el7_3.2
0:1.8.6p7-23.el7_3.2
sudo-debuginfo
Red Hat:rhel_aus:7.3::server
 before 0:1.8.6p7-23.el7_3.2
0:1.8.6p7-23.el7_3.2
sudo
Red Hat:rhel_e4s:7.3::server
 before 0:1.8.6p7-23.el7_3.2
0:1.8.6p7-23.el7_3.2
sudo-debuginfo
Red Hat:rhel_e4s:7.3::server
 before 0:1.8.6p7-23.el7_3.2
0:1.8.6p7-23.el7_3.2
sudo
Red Hat:rhel_tus:7.3::server
 before 0:1.8.6p7-23.el7_3.2
0:1.8.6p7-23.el7_3.2
sudo-debuginfo
Red Hat:rhel_tus:7.3::server
 before 0:1.8.6p7-23.el7_3.2
0:1.8.6p7-23.el7_3.2
sudo-devel
Red Hat:rhel_aus:7.3::server
 before 0:1.8.6p7-23.el7_3.2
0:1.8.6p7-23.el7_3.2
sudo-devel
Red Hat:rhel_e4s:7.3::server
 before 0:1.8.6p7-23.el7_3.2
0:1.8.6p7-23.el7_3.2
sudo-devel
Red Hat:rhel_tus:7.3::server
 before 0:1.8.6p7-23.el7_3.2
0:1.8.6p7-23.el7_3.2
sudo
Red Hat:rhel_aus:7.2::server
 before 0:1.8.6p7-17.el7_2.2
0:1.8.6p7-17.el7_2.2
sudo-debuginfo
Red Hat:rhel_aus:7.2::server
 before 0:1.8.6p7-17.el7_2.2
0:1.8.6p7-17.el7_2.2
sudo
Red Hat:rhel_e4s:7.2::server
 before 0:1.8.6p7-17.el7_2.2
0:1.8.6p7-17.el7_2.2
sudo-debuginfo
Red Hat:rhel_e4s:7.2::server
 before 0:1.8.6p7-17.el7_2.2
0:1.8.6p7-17.el7_2.2
sudo
Red Hat:rhel_tus:7.2::server
 before 0:1.8.6p7-17.el7_2.2
0:1.8.6p7-17.el7_2.2
sudo-debuginfo
Red Hat:rhel_tus:7.2::server
 before 0:1.8.6p7-17.el7_2.2
0:1.8.6p7-17.el7_2.2
sudo-devel
Red Hat:rhel_aus:7.2::server
 before 0:1.8.6p7-17.el7_2.2
0:1.8.6p7-17.el7_2.2
sudo-devel
Red Hat:rhel_e4s:7.2::server
 before 0:1.8.6p7-17.el7_2.2
0:1.8.6p7-17.el7_2.2
sudo-devel
Red Hat:rhel_tus:7.2::server
 before 0:1.8.6p7-17.el7_2.2
0:1.8.6p7-17.el7_2.2
sudo
Red Hat:enterprise_linux:8::baseos
 before 0:1.8.25p1-8.el8_1
0:1.8.25p1-8.el8_1
sudo-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.8.25p1-8.el8_1
0:1.8.25p1-8.el8_1
sudo-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:1.8.25p1-8.el8_1
0:1.8.25p1-8.el8_1
sudo
Red Hat:rhel_aus:6.6::server
 before 0:1.8.6p3-15.el6_6.2
0:1.8.6p3-15.el6_6.2
sudo-debuginfo
Red Hat:rhel_aus:6.6::server
 before 0:1.8.6p3-15.el6_6.2
0:1.8.6p3-15.el6_6.2
sudo-devel
Red Hat:rhel_aus:6.6::server
 before 0:1.8.6p3-15.el6_6.2
0:1.8.6p3-15.el6_6.2
sudo
Red Hat:enterprise_linux:6::client
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo-devel
Red Hat:enterprise_linux:6::client
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo
Red Hat:enterprise_linux:6::server
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo-devel
Red Hat:enterprise_linux:6::server
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.6p3-29.el6_10.2
0:1.8.6p3-29.el6_10.2
sudo
Red Hat:rhel_aus:6.5::server
 before 0:1.8.6p3-12.el6_5.2
0:1.8.6p3-12.el6_5.2
sudo-debuginfo
Red Hat:rhel_aus:6.5::server
 before 0:1.8.6p3-12.el6_5.2
0:1.8.6p3-12.el6_5.2
sudo-devel
Red Hat:rhel_aus:6.5::server
 before 0:1.8.6p3-12.el6_5.2
0:1.8.6p3-12.el6_5.2
sudo
Red Hat:rhel_els:5
 before 0:1.7.2p1-31.el5_11.1
0:1.7.2p1-31.el5_11.1
sudo-debuginfo
Red Hat:rhel_els:5
 before 0:1.7.2p1-31.el5_11.1
0:1.7.2p1-31.el5_11.1
sudo
Red Hat:rhel_e4s:8.0::baseos
 before 0:1.8.25p1-4.el8_0.2
0:1.8.25p1-4.el8_0.2
sudo-debuginfo
Red Hat:rhel_e4s:8.0::baseos
 before 0:1.8.25p1-4.el8_0.2
0:1.8.25p1-4.el8_0.2
sudo-debugsource
Red Hat:rhel_e4s:8.0::baseos
 before 0:1.8.25p1-4.el8_0.2
0:1.8.25p1-4.el8_0.2
sudo
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 1.7.6p2-0.30.5.1
1.7.6p2-0.30.5.1
sudo
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.7.6p2-0.30.5.1
1.7.6p2-0.30.5.1
sudo
SUSE:Linux Enterprise Module for Basesystem 15
 before 1.8.22-4.6.1
1.8.22-4.6.1
sudo
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 1.8.22-4.6.1
1.8.22-4.6.1
sudo
SUSE:HPE Helion OpenStack 8
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:OpenStack Cloud 8
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:OpenStack Cloud Crowbar 8
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:Linux Enterprise Desktop 12 SP4
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:Linux Enterprise Server 12 SP4
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:Enterprise Storage 5
 before 1.8.20p2-3.14.1
1.8.20p2-3.14.1
sudo
SUSE:OpenStack Cloud 7
 before 1.8.10p3-10.23.1
1.8.10p3-10.23.1
sudo
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 1.8.10p3-10.23.1
1.8.10p3-10.23.1
sudo
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 1.8.10p3-10.23.1
1.8.10p3-10.23.1
sudo
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.8.10p3-10.23.1
1.8.10p3-10.23.1
sudo
SUSE:Enterprise Storage 4
 before 1.8.10p3-10.23.1
1.8.10p3-10.23.1
sudo
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 1.8.10p3-2.28.1
1.8.10p3-2.28.1
sudo
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 1.8.10p3-2.28.1
1.8.10p3-2.28.1
sudo
Ubuntu:Pro:14.04:LTS
 before 1.8.9p5-1ubuntu1.5+esm2, plus listed versions
1.8.6p3-0ubuntu31.8.8-2ubuntu11.8.8-2ubuntu21.8.9p4-1ubuntu11.8.9p4-1ubuntu2
Show 6 moreShow less
1.8.9p5-1ubuntu11.8.9p5-1ubuntu1.11.8.9p5-1ubuntu1.21.8.9p5-1ubuntu1.31.8.9p5-1ubuntu1.41.8.9p5-1ubuntu1.5+esm1
1.8.9p5-1ubuntu1.5+esm2
sudo
Ubuntu:16.04:LTS
 before 1.8.16-0ubuntu1.8, plus listed versions
1.8.12-1ubuntu31.8.16-0ubuntu11.8.16-0ubuntu1.11.8.16-0ubuntu1.21.8.16-0ubuntu1.3
Show 4 moreShow less
1.8.16-0ubuntu1.41.8.16-0ubuntu1.51.8.16-0ubuntu1.61.8.16-0ubuntu1.7
1.8.16-0ubuntu1.8
sudo
Ubuntu:18.04:LTS
 before 1.8.21p2-3ubuntu1.1, plus listed versions
1.8.20p2-1ubuntu11.8.21p2-2ubuntu11.8.21p2-3ubuntu1
1.8.21p2-3ubuntu1.1
sudo
openSUSE:Leap 15.1
 before 1.8.22-lp151.5.3.1
1.8.22-lp151.5.3.1
sudo
openSUSE:Leap 15.0
 before 1.8.22-lp150.8.1
1.8.22-lp150.8.1
sudo
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 1.9.7p2-1.4
1.9.7p2-1.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubCashWilliams/CVE-2019-14287-demo2019-10-15
Exploit-DBsudo 1.8.27 - Security Bypass2019-10-15
PoC in GitHubFauxFaux/sudo-cve-2019-142872019-10-15
PoC in GitHubn0w4n/CVE-2019-142872019-10-15
PoC in GitHubgurneesh/CVE-2019-14287-write-up2019-10-16
PoC in GitHubshallvhack/Sudo-Security-Bypass-CVE-2019-142872019-10-18
PoC in GitHubhuang919/cve-2019-14287-PPT2019-10-28
PoC in GitHubwenyu1999/sudo-2019-11-11
PoC in GitHubSindadziy/cve-2019-142872019-11-12
PoC in GitHubSindayifu/CVE-2019-14287-CVE-2014-62712019-11-13
Show 16 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubCMNatic/Dockerized-CVE-2019-142872020-02-09
PoC in GitHubaxax002/sudo-vulnerability-CVE-2019-142872020-04-26
PoC in GitHubHussyCool/CVE-2019-14287-IT18030372-2020-05-11
PoC in GitHubsachinthadesilva/Exploit-CVE-2019-142872020-05-11
PoC in GitHubDewmiApsara/CVE-2019-142872020-05-12
PoC in GitHubShianTrish/sudo-Security-Bypass-vulnerability-CVE-2019-142872020-05-12
PoC in GitHubejlevin99/Sudo-Security-Bypass-Vulnerability2020-05-12
PoC in GitHubjanod313/-CVE-2019-14287-SUDO-bypass-vulnerability2020-05-12
PoC in GitHubthinuri99/Sudo-Security-Bypass-Vulnerability-CVE-2019-14287-2020-05-12
PoC in GitHubM108Falcon/Sudo-CVE-2019-142872020-09-18
PoC in GitHubedsonjt81/CVE-2019-14287-2021-04-25
PoC in GitHubDularaAnushka/Linux-Privilege-Escalation-using-Sudo-Rights2021-05-20
PoC in GitHubh3x0v3rl0rd/CVE-2019-142872021-06-17
PoC in GitHubHasintha-98/Sudo-Vulnerability-Exploit-CVE-2019-142872021-10-13
PoC in GitHubMariliaMeira/CVE-2019-142872022-10-12
PoC in GitHublemonadern/poc-cve-2019-142872024-10-13

History

History
RecordedChangedSources
affected, facts
affectedOSV
exploits, exploits_more
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-14287 is a high vulnerability (CVSS 8.8) in Sudo Project Sudo, published October 14, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 63.8%, the 99th percentile. Fixed in sudo 1.8.27-r1.

References

Show 89 moreShow less
This page doesn't list everything

The full exploit list has 2 more links.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open