{"id":"CVE-2019-18276","aliases":["BELL-CVE-2019-18276","CLSA-2022-1650909007","CLSA-2022-1650910003","CLSA-2022-1651685129","CLSA-2025-1761326171","DEBIAN-CVE-2019-18276","EUVD-2019-8065","GHSA-jcxc-5f87-vq5m","MGASA-2021-0288","RHSA-2021:1679","UBUNTU-CVE-2019-18276","USN-5380-1"],"status":"published","title":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By...","description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02608,"percentile":0.85508,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-273"],"published":"2019-11-28T00:27:51Z","modified":"2026-10-15T07:47:25Z","exploits":[{"source":"pocgithub","id":"M-ensimag/CVE-2019-18276","title":"M-ensimag/CVE-2019-18276","date":"2021-12-09","url":"https://github.com/M-ensimag/CVE-2019-18276"},{"source":"pocgithub","id":"SABI-Ensimag/CVE-2019-18276","title":"SABI-Ensimag/CVE-2019-18276","date":"2022-01-12","url":"https://github.com/SABI-Ensimag/CVE-2019-18276"}],"fixes":[{"ecosystem":"TuxCare:OracleLinux:6","package":"bash","fixed_in":["4.1.2-48.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"bash-doc","fixed_in":["4.1.2-48.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"bash","fixed_in":["4.1.2-48.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"bash-doc","fixed_in":["4.1.2-48.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"bash","fixed_in":["4.3-14ubuntu1.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"bash-builtins","fixed_in":["4.3-14ubuntu1.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"bash-doc","fixed_in":["4.3-14ubuntu1.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"bash-static","fixed_in":["4.3-14ubuntu1.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"bash","fixed_in":["5.0-4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"bash-builtins","fixed_in":["5.0-4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"bash-doc","fixed_in":["5.0-4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"bash-static","fixed_in":["5.0-4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"bash","fixed_in":["5.1~rc1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bash","fixed_in":["5.1~rc1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bash","fixed_in":["5.1~rc1-2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"bash","fixed_in":["4.4-23.1.2.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bash","fixed_in":["0:4.4.19-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bash-debuginfo","fixed_in":["0:4.4.19-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bash-debugsource","fixed_in":["0:4.4.19-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bash-doc","fixed_in":["0:4.4.19-14.el8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bash","fixed_in":["4.3-7ubuntu1.8+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bash","fixed_in":["4.3-14ubuntu1.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"bash","fixed_in":["4.4.18-2ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"bash","fixed_in":["5.0-6ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-48.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-48.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-48.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-48.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-14ubuntu1.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"bash-builtins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-14ubuntu1.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-14ubuntu1.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"bash-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-14ubuntu1.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0-4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"bash-builtins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0-4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0-4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"bash-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0-4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1~rc1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1~rc1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1~rc1-2"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4-23.1.2.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.19-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.19-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bash-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.19-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.19-14.el8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-7ubuntu1.8+esm2"}]}],"versions":["4.2-5ubuntu3","4.3-1ubuntu2","4.3-2ubuntu1","4.3-3ubuntu1","4.3-4ubuntu1","4.3-4ubuntu2","4.3-6ubuntu1","4.3-7ubuntu1","4.3-7ubuntu1.1","4.3-7ubuntu1.2","4.3-7ubuntu1.3","4.3-7ubuntu1.4","4.3-7ubuntu1.5","4.3-7ubuntu1.6","4.3-7ubuntu1.7","4.3-7ubuntu1.8","4.3-7ubuntu1.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-14ubuntu1.4+esm1"}]}],"versions":["4.3-14ubuntu1","4.3-14ubuntu1.1","4.3-14ubuntu1.2","4.3-14ubuntu1.3","4.3-14ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.18-2ubuntu1.3"}]}],"versions":["4.4-5ubuntu1","4.4.18-1ubuntu1","4.4.18-2ubuntu1","4.4.18-2ubuntu1.1","4.4.18-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0-6ubuntu1.2"}]}],"versions":["5.0-4ubuntu1","5.0-5ubuntu1","5.0-6ubuntu1","5.0-6ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-7ubuntu1.8+esm2"}]}],"versions":["4.2-5ubuntu3","4.3-1ubuntu2","4.3-2ubuntu1","4.3-3ubuntu1","4.3-4ubuntu1","4.3-4ubuntu2","4.3-6ubuntu1","4.3-7ubuntu1","4.3-7ubuntu1.1","4.3-7ubuntu1.2","4.3-7ubuntu1.3","4.3-7ubuntu1.4","4.3-7ubuntu1.5","4.3-7ubuntu1.6","4.3-7ubuntu1.7","4.3-7ubuntu1.8","4.3-7ubuntu1.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-14ubuntu1.4+esm1"}]}],"versions":["4.3-14ubuntu1","4.3-14ubuntu1.1","4.3-14ubuntu1.2","4.3-14ubuntu1.3","4.3-14ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.18-2ubuntu1.3"}]}],"versions":["4.4-5ubuntu1","4.4.18-1ubuntu1","4.4.18-2ubuntu1","4.4.18-2ubuntu1.1","4.4.18-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0-6ubuntu1.2"}]}],"versions":["5.0-4ubuntu1","5.0-5ubuntu1","5.0-6ubuntu1","5.0-6ubuntu1.1"]}],"products":[{"vendor":"gnu","product":"bash"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"oncommand_unified_manager"},{"vendor":"netapp","product":"solidfire"},{"vendor":"oracle","product":"communications_cloud_native_core_policy"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202105-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.youtube.com/watch?v=-wGtxJ8opa8","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://security.netapp.com/advisory/ntap-20200430-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18276","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"},{"url":"https://security.netapp.com/advisory/ntap-20200430-0003"},{"url":"https://github.com/advisories/GHSA-jcxc-5f87-vq5m"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-18276","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1650909007.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1650910003.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1651685129","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1761326171.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-18276","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0288.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28937","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1679","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1778309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1890888","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1679.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-18276","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18276","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2019-18276","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5380-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-18276","description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.","status":"published","published":"2019-11-28T00:27:51Z","modified":"2026-10-14T06:54:52.201Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2019-8065","description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.","status":"published","published":"2019-11-28T00:27:51Z","modified":"2026-10-14T06:54:52Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-jcxc-5f87-vq5m","title":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By...","description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.","status":"published","published":"2022-05-24T17:02:24Z","modified":"2026-10-14T09:32:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T15:13:23.530725Z"}],"nvd":[{"id":"CVE-2019-18276","description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.","status":"published","published":"2019-11-28T01:15:10.603Z","modified":"2026-10-14T07:16:50.14Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"BELL-CVE-2019-18276","title":"CVE-2019-18276 does not affect BellSoft software","status":"withdrawn","published":"2019-11-28T01:15:00Z","modified":"2026-01-26T09:49:28.003547Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-18276","description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.","status":"published","published":"2019-11-28T01:15:10.603Z","modified":"2026-04-16T04:42:18.504531077Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-18276","description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.","status":"published","published":"2019-11-28T01:15:10.603Z","modified":"2026-10-15T07:47:25.065185709Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2021:1679","title":"Red Hat Security Advisory: bash security and bug fix update","status":"published","published":"2024-09-16T05:11:43Z","modified":"2025-11-22T12:20:09Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2019-18276","description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.","status":"published","published":"2019-11-28T01:15:00Z","modified":"2026-02-04T03:43:14.789534Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"CLSA-2022-1650909007","title":"Fixed CVE-2019-18276 in bash","description":"- CVE-2019-18276: Fix priviledge dropping when running with effective\n  UID not equal to real UID","status":"published","published":"2022-04-25T17:50:07Z","modified":"2026-06-01T00:33:24.321890446Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1650910003","title":"Fix of CVE: CVE-2019-18276","description":"- CVE-2019-18276: Fix priviledge dropping when running with effective\n  UID not equal to real UID","status":"published","published":"2022-04-25T18:06:43Z","modified":"2026-06-01T00:33:15.605757813Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1651685129","title":"Fix CVE(s): CVE-2019-18276","description":"\n   * SECURITY UPDATE: privilege gain via setuid\n     - debian/patches/CVE-2019-18276.patch: replace the use of\n       setuid and setgid when possible with setresuid and setresgid,\n       respectively.\n     - CVE-2019-18276","status":"published","published":"2022-05-04T17:25:29Z","modified":"2026-06-04T10:03:22.111868Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2025-1761326171","title":"Fix CVE(s): CVE-2019-18276","description":"   * SECURITY UPDATE: privilege escalation vulnerability in privileged mode\n     - debian/patches/CVE-2019-18276.patch: fix setuid/setgid handling\n       when bash is running in privileged mode, use setresuid/setresgid\n       over setuid/setgid when available\n     - CVE-2019-18276","status":"published","published":"2025-10-24T17:16:15Z","modified":"2026-06-04T10:03:40.657201Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"MGASA-2021-0288","title":"Updated bash packages fix a security vulnerability","description":"A privilege escalation vulnerability was found in bash in the way it dropped\nprivileges when started with an effective user id not equal to the real user\nid. Bash may be vulnerable to this flaw if the setuid permission is set and\nthe owner of the bash program itself is a non-root user. A local attacker\ncould exploit this flaw to escalate their privileges on the system\n(CVE-2019-18276).\n","status":"published","published":"2021-06-28T21:16:35Z","modified":"2026-04-16T04:43:28.795718108Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"USN-5380-1","title":"bash vulnerability","description":"It was discovered that Bash did not properly drop privileges\nwhen the binary had the setuid bit enabled. An attacker could\npossibly use this issue to escalate privileges.\n","status":"published","published":"2022-04-20T07:41:07Z","modified":"2026-06-29T13:49:36.439916966Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}