CoreCVE
Back

HIGH

In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command

Published Jan 28, 2021

Description

In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-459

CWE-909

References (6)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jan 28, 2021
Updated Aug 5, 2024
Reserved Jan 28, 2021
Link CVE-2019-25016
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-25016
Red Hat
Severity n/a
Public date n/a
Links CVE-2019-25016
ENISA EUVD
Assigner mitre
Published Jan 28, 2021
Updated Aug 5, 2024
Exploited since n/a
Link EUVD-2019-11469
EUVD-2019-11469