{"id":"CVE-2019-19234","aliases":["BELL-CVE-2019-19234","DEBIAN-CVE-2019-19234","EUVD-2019-8860","GHSA-vh47-792w-24m4","MGASA-2020-0246","RHSA-2020:1804","UBUNTU-CVE-2019-19234"],"status":"disputed","title":"In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in...","description":"In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the _shell_ of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0317,"percentile":0.88125,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-12-19T20:35:02Z","modified":"2026-09-21T07:01:55Z","fixes":[{"ecosystem":"Debian:12","package":"sudo","fixed_in":["1.8.31-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sudo","fixed_in":["1.8.31-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sudo","fixed_in":["1.8.31-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"sudo","fixed_in":["1.8.31-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.31-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.31-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.31-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.31p1-1.1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.29-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.29-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.29-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.31-1ubuntu1"}]}],"versions":["1.8.27-1ubuntu4","1.8.29-1ubuntu1"]}],"products":[{"vendor":"sudo","product":"sudo"}],"references":[{"url":"https://www.sudo.ws/stable.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://www.sudo.ws/devel.html#1.8.30b2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20200103-0004/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://support2.windriver.com/index.php?page=defects\u0026on=view\u0026id=LIN1018-5505","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58104","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58473","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58772","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs60748","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.tenable.com/plugins/nessus/132985","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://support2.windriver.com/index.php?page=defects\u0026on=view\u0026id=LIN1019-3816","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-19234","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19234/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k20-0001.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://access.redhat.com/security/cve/cve-2019-19234","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/bulletinapr2020.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19234","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19234"},{"url":"https://security.netapp.com/advisory/ntap-20200103-0004"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F"},{"url":"https://github.com/advisories/GHSA-vh47-792w-24m4"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-19234","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19234","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0246.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26314","tags":["report"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19232","tags":["advisory"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19234","tags":["advisory"]},{"url":"https://www.sudo.ws/legacy.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1804","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1679508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1715516","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1733961","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1786704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1796518","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1804.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19232","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19232","tags":["advisory"]},{"url":"https://www.sudo.ws/stable.html#1.8.30","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19234","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1786708","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19234","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2019-19234","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-19234","description":"In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the _shell_ of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash","status":"disputed","published":"2019-12-19T20:35:02Z","modified":"2024-08-05T02:09:39.475Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-8860","description":"In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the _shell_ of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash","status":"published","published":"2019-12-19T20:35:02Z","modified":"2024-08-05T02:09:39Z","updated_at":"2026-11-03T02:40:26.287407Z"}],"ghsa":[{"id":"GHSA-vh47-792w-24m4","title":"In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in...","description":"In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user.","status":"published","published":"2022-05-24T17:04:44Z","modified":"2024-03-30T05:01:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:55:44.65747Z"}],"nvd":[{"id":"CVE-2019-19234","description":"In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the _shell_ of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash","status":"disputed","published":"2019-12-19T21:15:13.823Z","modified":"2026-06-17T02:26:20.74Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:40.856496Z"}],"osv":[{"id":"BELL-CVE-2019-19234","title":"CVE-2019-19234 does not affect BellSoft software","status":"withdrawn","published":"2019-12-19T21:15:00Z","modified":"2026-01-26T09:46:38.665378Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-19234","description":"In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the _shell_ of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash","status":"published","published":"2019-12-19T21:15:13.823Z","modified":"2026-04-16T04:43:33.600441851Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19234","description":"In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the _shell_ of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash","status":"published","published":"2019-12-19T21:15:13.823Z","modified":"2026-09-21T07:01:55.155354033Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2020:1804","title":"Red Hat Security Advisory: sudo security, bug fix, and enhancement update","status":"published","published":"2024-09-16T03:06:08Z","modified":"2025-11-22T12:00:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2019-19234","description":"In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the _shell_ of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash","status":"published","published":"2019-12-19T21:15:00Z","modified":"2025-09-08T16:45:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"MGASA-2020-0246","title":"Updated sudo packages fix security vulnerability","description":"Updated sudo packages fix security vulnerabilities:\n\nIt was found that sudo always allowed commands to be run with unknown\nuser or group ids if the sudo configuration allowed it for example via\nthe \"ALL\" alias. This could allow sudo to impersonate non-existent\naccount and depending on how applications are configured, could lead to\ncertain restriction bypass. This is now explicitly disabled. A new\nsetting called \"allow_unknown_runas_id\" was introduced in order to enable\nthis (CVE-2019-19232).\n\nWhen an account is disabled via the shadow file, by replacing the\npassword hash with \"!\", it is not considered disabled by sudo. And\ndepending on the configuration, sudo can be run by using such disabled\naccount (CVE-2019-19234).\n\nThe sudo package has been updated to version 1.8.31p1, fixing these\nissues and other bugs.\n","status":"published","published":"2020-06-10T22:26:12Z","modified":"2026-04-16T04:42:08.972772512Z","updated_at":"2026-11-02T15:49:41.151324Z"}]}}