Vulnerability Details CVE-2019-25016
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.01
EPSS Ranking 75.9%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
- https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168
- https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d
- https://github.com/Duncaen/OpenDoas/issues/45
- https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1
- https://security.gentoo.org/glsa/202107-11
- https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168
- https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d
- https://github.com/Duncaen/OpenDoas/issues/45
- https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1
- https://security.gentoo.org/glsa/202107-11
Products affected by CVE-2019-25016
-
cpe:2.3:a:opendoas_project:opendoas:6.6
-
cpe:2.3:a:opendoas_project:opendoas:6.6.1
-
cpe:2.3:a:opendoas_project:opendoas:6.8