{"id":"CVE-2019-14868","aliases":["DEBIAN-CVE-2019-14868","DLA-2284-1","EUVD-2019-5983","GHSA-2x84-7422-962r","MGASA-2021-0141","RHSA-2020:0431","RHSA-2020:0515","RHSA-2020:0559","RHSA-2020:0568","RHSA-2020:1332","RHSA-2020:1333","RHSA-2020:2210","RHSA-2020:5351","RHSA-2020:5352","SUSE-SU-2024:2756-1","UBUNTU-CVE-2019-14868","openSUSE-SU-2024:14252-1"],"status":"published","title":"In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables....","description":"In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01385,"percentile":0.72433,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2020-04-02T16:48:57Z","modified":"2026-10-20T13:56:02Z","fixes":[{"ecosystem":"Debian:11","package":"ksh","fixed_in":["2020.0.0-2.1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"ksh","fixed_in":["93u+20120801-3.1+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"ksh","fixed_in":["2020.0.0.81.git8052490-0.1.1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"ksh","fixed_in":["0:20120801-253.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"ksh-debuginfo","fixed_in":["0:20120801-253.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"ksh-debugsource","fixed_in":["0:20120801-253.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"ksh","fixed_in":["0:20120801-38.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"ksh-debuginfo","fixed_in":["0:20120801-38.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ksh","fixed_in":["0:20120801-38.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ksh-debuginfo","fixed_in":["0:20120801-38.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"ksh","fixed_in":["0:20120801-38.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"ksh-debuginfo","fixed_in":["0:20120801-38.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ksh","fixed_in":["0:20120801-38.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ksh-debuginfo","fixed_in":["0:20120801-38.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ksh","fixed_in":["0:20120801-253.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ksh-debuginfo","fixed_in":["0:20120801-253.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ksh-debugsource","fixed_in":["0:20120801-253.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"ksh","fixed_in":["0:20120801-140.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"ksh-debuginfo","fixed_in":["0:20120801-140.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ksh","fixed_in":["0:20120801-140.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ksh-debuginfo","fixed_in":["0:20120801-140.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"ksh","fixed_in":["0:20120801-140.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"ksh-debuginfo","fixed_in":["0:20120801-140.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ksh","fixed_in":["0:20120801-140.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ksh-debuginfo","fixed_in":["0:20120801-140.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.5::computenode","package":"ksh","fixed_in":["0:20120801-138.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.5::computenode","package":"ksh-debuginfo","fixed_in":["0:20120801-138.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.5::server","package":"ksh","fixed_in":["0:20120801-138.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.5::server","package":"ksh-debuginfo","fixed_in":["0:20120801-138.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"ksh","fixed_in":["0:20120801-140.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"ksh-debuginfo","fixed_in":["0:20120801-140.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::server","package":"ksh","fixed_in":["0:20120801-140.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::server","package":"ksh-debuginfo","fixed_in":["0:20120801-140.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.4::server","package":"ksh","fixed_in":["0:20120801-36.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.4::server","package":"ksh-debuginfo","fixed_in":["0:20120801-36.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"ksh","fixed_in":["0:20120801-36.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"ksh-debuginfo","fixed_in":["0:20120801-36.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:7.4::server","package":"ksh","fixed_in":["0:20120801-36.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:7.4::server","package":"ksh-debuginfo","fixed_in":["0:20120801-36.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.3::server","package":"ksh","fixed_in":["0:20120801-27.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.3::server","package":"ksh-debuginfo","fixed_in":["0:20120801-27.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.2::server","package":"ksh","fixed_in":["0:20120801-26.el7_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.2::server","package":"ksh-debuginfo","fixed_in":["0:20120801-26.el7_2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"ksh","fixed_in":["93vu-19.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ksh","fixed_in":["93vu-19.3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ksh","fixed_in":["93u+20120801-1ubuntu0.14.04.1+esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ksh","fixed_in":["93vu-10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.0.0-2.1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"93u+20120801-3.1+deb9u1"}]}],"versions":["93u+20120801-3.1"]},{"source":"osv","ecosystem":"Mageia:7","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.0.0.81.git8052490-0.1.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-253.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-253.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"ksh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-253.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-38.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-38.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-38.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-38.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-38.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-38.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-38.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-38.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-253.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-253.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ksh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-253.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::computenode","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-138.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::computenode","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-138.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::server","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-138.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::server","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-138.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::server","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::server","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-140.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-36.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-36.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-36.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-36.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-36.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-36.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.3::server","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-27.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.3::server","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-27.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.2::server","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-26.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.2::server","package":"ksh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20120801-26.el7_2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"93vu-19.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"93vu-19.3.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"93u+20120801-1ubuntu0.14.04.1+esm1"}]}],"versions":["93u+20120801-1","93u+20120801-1ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["93u+20120801-1","93u+20120801-1.1","93u+20120801-1.2","93u+20120801-2","93u+20120801-2ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["93u+20120801-3.1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ksh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"93vu-10.1"}]}]}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"debian","product":"debian_linux"},{"vendor":"kornshell","product":"ksh"},{"vendor":"ksh_project","product":"ksh"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14868","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://support.apple.com/kb/HT211170","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2020/May/53","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00015.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14868","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0431","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0515","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0559","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0568","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1332","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1333","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2210","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5351","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5352","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14868","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757324","tags":["report"]},{"url":"https://github.com/advisories/GHSA-2x84-7422-962r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14868","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0141.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26213","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/N4R57SLEOTTXFWOLPTVVS2AOZ35FZEJR/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0431.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14868","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0515.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0559.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0568.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1332.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1333.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2210.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5351.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5352.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242756-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1129288","tags":["report"]},{"url":"https://bugzilla.suse.com/1160796","tags":["report"]},{"url":"https://bugzilla.suse.com/1224057","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14868","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-14868","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-14868","description":"In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.","status":"published","published":"2020-04-02T16:48:57Z","modified":"2024-08-05T00:26:39.141Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-5983","description":"In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.","status":"published","published":"2020-04-02T16:48:57Z","modified":"2024-08-05T00:26:39Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:40:38.166988Z"}],"ghsa":[{"id":"GHSA-2x84-7422-962r","title":"In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables....","description":"In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.","status":"published","published":"2022-05-24T17:13:14Z","modified":"2023-02-10T05:06:58Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:54:03.327923Z"}],"nvd":[{"id":"CVE-2019-14868","description":"In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.","status":"published","published":"2020-04-02T17:15:13.99Z","modified":"2026-06-17T02:19:12.387Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"CVE-2019-14868","description":"In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.","status":"published","published":"2020-04-02T17:15:13.99Z","modified":"2026-10-20T13:56:02.639176829Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DEBIAN-CVE-2019-14868","description":"In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.","status":"published","published":"2020-04-02T17:15:13.99Z","modified":"2026-08-29T07:01:51.595947305Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2020:0431","title":"Red Hat Security Advisory: ksh security update","status":"published","published":"2024-09-16T03:28:59Z","modified":"2025-11-22T11:55:10Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0515","title":"Red Hat Security Advisory: ksh security update","status":"published","published":"2024-09-16T03:29:07Z","modified":"2026-06-26T10:46:07Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0559","title":"Red Hat Security Advisory: ksh security update","status":"published","published":"2024-09-16T03:29:14Z","modified":"2025-11-22T11:55:34Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0568","title":"Red Hat Security Advisory: ksh security update","status":"published","published":"2024-09-16T03:29:22Z","modified":"2026-06-26T10:46:13Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1332","title":"Red Hat Security Advisory: ksh security update","status":"published","published":"2024-09-16T03:29:37Z","modified":"2026-06-26T10:47:23Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1333","title":"Red Hat Security Advisory: ksh security update","status":"published","published":"2024-09-16T03:29:30Z","modified":"2026-06-26T10:47:24Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:2210","title":"Red Hat Security Advisory: ksh security update","status":"published","published":"2024-09-16T03:29:44Z","modified":"2025-11-22T12:01:41Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:5351","title":"Red Hat Security Advisory: ksh security update","status":"published","published":"2024-09-16T03:29:51Z","modified":"2025-11-22T12:13:42Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5352","title":"Red Hat Security Advisory: ksh security update","status":"published","published":"2024-09-16T03:29:58Z","modified":"2025-11-22T12:13:43Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2019-14868","description":"In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.","status":"published","published":"2020-04-02T17:15:00Z","modified":"2025-10-24T04:47:46Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-2284-1","title":"ksh - security update","status":"published","published":"2020-07-21T00:00:00Z","modified":"2026-03-09T01:20:21.697902Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2021-0141","title":"Updated ksh packages fix security vulnerability","description":"A flaw was found in the way ksh evaluates certain environment variables. An\nattacker could use this flaw to override or bypass environment restrictions to\nexecute shell commands. Services and applications that allow remote\nunauthenticated attackers to provide one of those environment variables could\nallow them to exploit this issue remotely (CVE-2019-14868).\n","status":"published","published":"2021-03-17T11:01:53Z","modified":"2026-04-16T04:43:59.154196299Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:14252-1","title":"ksh-93vu-10.1 on GA media","description":"These are all security issues fixed in the ksh-93vu-10.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-09T00:00:00Z","modified":"2025-05-07T18:10:42.832269Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2756-1","title":"Security update for ksh","description":"This update for ksh fixes the following issues:\n\n- CVE-2019-14868: Fixed code injection due to environment variables on startup interpreted as arithmetic expression (bsc#1160796)\n    \nOther fixes:\n- do not use posix_spawn as it lacks proper job handling (bsc#1224057)\n- fix segfault in variable substitution (bsc#1129288)\n","status":"published","published":"2024-08-05T19:57:56Z","modified":"2026-02-04T02:42:23.142724Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}