Description
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.8.27-1.1 | — |
| Debian 13 | sudo | 1.8.27-1.1 | — |
| Debian 12 | sudo | 1.8.27-1.1 | — |
| Debian 10 | sudo | 1.8.27-1+deb10u1 | DSA-4543-1 |
| Debian 9 | sudo | 1.8.19p1-2.1+deb9u1 | DSA-4543-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | sudo | 1.8.10p3-1+deb8u6 | DLA-1964-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | sudo | 1.8.21p2-3ubuntu1.1 | USN-4154-1 |
| Ubuntu 16.04 LTS | sudo | 1.8.16-0ubuntu1.8 | USN-4154-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | sudo | 1.8.9p5-1ubuntu1.5+esm2 | USN-4154-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | sudo | 1.8.25p1-8.el8_1 | RHSA-2019:3694 |
| RHEL 7 | redhat-release-virtualization-host +2 | 4.2-15.1.el7 | RHBA-2019:3248 |
| RHEL 7 | redhat-virtualization-host +1 | 4.2-20191022.0.el7_6 | RHBA-2019:3248 |
| RHEL 7 | sudo +1 | 1.8.23-4.el7_7.1 | RHSA-2019:3197 |
| RHEL 6 | sudo +1 | 1.8.6p3-29.el6_10.2 | RHSA-2019:3755 |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.0 E4S | sudo | 1.8.25p1-4.el8_0.2 | RHSA-2020:0388 |
| RHEL 7.6 EUS | sudo +1 | 1.8.23-3.el7_6.1 | RHSA-2019:3205 |
| RHEL 7.5 EUS | sudo +1 | 1.8.19p2-14.el7_5.1 | RHSA-2019:3204 |
| RHEL 7.4 TUS | sudo +1 | 1.8.19p2-12.el7_4.1 | RHSA-2019:3209 |
| RHEL 7.4 E4S | sudo +1 | 1.8.19p2-12.el7_4.1 | RHSA-2019:3209 |
| RHEL 7.4 AUS | sudo +1 | 1.8.19p2-12.el7_4.1 | RHSA-2019:3209 |
| RHEL 7.3 TUS | sudo +1 | 1.8.6p7-23.el7_3.2 | RHSA-2019:3219 |
| RHEL 7.3 E4S | sudo +1 | 1.8.6p7-23.el7_3.2 | RHSA-2019:3219 |
| RHEL 7.3 AUS | sudo +1 | 1.8.6p7-23.el7_3.2 | RHSA-2019:3219 |
| RHEL 7.2 TUS | sudo +1 | 1.8.6p7-17.el7_2.2 | RHSA-2019:3278 |
| RHEL 7.2 E4S | sudo +1 | 1.8.6p7-17.el7_2.2 | RHSA-2019:3278 |
| RHEL 7.2 AUS | sudo +1 | 1.8.6p7-17.el7_2.2 | RHSA-2019:3278 |
| RHEL 6.6 AUS | sudo +1 | 1.8.6p3-15.el6_6.2 | RHSA-2019:3754 |
| RHEL 6.5 AUS | sudo +1 | 1.8.6p3-12.el6_5.2 | RHSA-2019:3895 |
| RHEL 5 ELS | sudo | 1.7.2p1-31.el5_11.1 | RHSA-2019:4191 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | sudo | 1.8.22-4.6.1 | SUSE-SU-2019:2656-1 |
| SLES 15 | sudo | 1.8.22-4.6.1 | SUSE-SU-2019:2656-1 |
| SLES 12 SP4 | sudo | 1.8.20p2-3.14.1 | SUSE-SU-2019:2666-1 |
| SLES 12 SP3 | sudo | 1.8.20p2-3.14.1 | SUSE-SU-2019:2666-1 |
| SLES 12 SP2 | sudo | 1.8.10p3-10.23.1 | SUSE-SU-2019:2667-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | sudo | 1.8.10p3-2.28.1 | SUSE-SU-2019:2668-1 |
| SLES 11 SP4 | sudo | 1.7.6p2-0.30.5.1 | SUSE-SU-2019:14193-1 |
| SLES for SAP 12 SP4 | sudo | 1.8.20p2-3.14.1 | SUSE-SU-2019:2666-1 |
| SLES for SAP 12 SP3 | sudo | 1.8.20p2-3.14.1 | SUSE-SU-2019:2666-1 |
| SLES for SAP 12 SP2 | sudo | 1.8.10p3-10.23.1 | SUSE-SU-2019:2667-1 |
| SLES for SAP 12 SP1 | sudo | 1.8.10p3-2.28.1 | SUSE-SU-2019:2668-1 |
| SUSE OpenStack Cloud Crowbar 8 | sudo | 1.8.20p2-3.14.1 | SUSE-SU-2019:2666-1 |
| SUSE OpenStack Cloud 8 | sudo | 1.8.20p2-3.14.1 | SUSE-SU-2019:2666-1 |
| SUSE OpenStack Cloud 7 | sudo | 1.8.10p3-10.23.1 | SUSE-SU-2019:2667-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | sudo | 1.7.6p2-0.30.5.1 | SUSE-SU-2019:14193-1 |
| SUSE HPE Helion OpenStack 8 | sudo | 1.8.20p2-3.14.1 | SUSE-SU-2019:2666-1 |
| SUSE Enterprise Storage 5 | sudo | 1.8.20p2-3.14.1 | SUSE-SU-2019:2666-1 |
| SUSE Enterprise Storage 4 | sudo | 1.8.10p3-10.23.1 | SUSE-SU-2019:2667-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sudo | 1.9.7p2-1.4 | openSUSE-SU-2024:11413-1 |
| openSUSE Leap 15.1 | sudo | 1.8.22-lp151.5.3.1 | openSUSE-SU-2019:2316-1 |
| openSUSE Leap 15.0 | sudo | 1.8.22-lp150.8.1 | openSUSE-SU-2019:2333-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | sudo | 1.8.28-r0 | — |
| Alpine v3.23 | sudo | 1.8.28-r0 | — |
| Alpine v3.22 | sudo | 1.8.28-r0 | — |
| Alpine v3.21 | sudo | 1.8.28-r0 | — |
| Alpine v3.20 | sudo | 1.8.28-r0 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | sudo | 1.8.28-r0 | — |
| Alpine v3.18 | sudo | 1.8.28-r0 | — |
| Alpine v3.17 | sudo | 1.8.28-r0 | — |
| Alpine v3.16 | sudo | 1.8.28-r0 | — |
| Alpine v3.15 | sudo | 1.8.28-r0 | — |
| Alpine v3.14 | sudo | 1.8.28-r0 | — |
| Alpine v3.13 | sudo | 1.8.28-r0 | — |
| Alpine v3.12 | sudo | 1.8.28-r0 | — |
| Alpine v3.11 | sudo | 1.8.28-r0 | — |
| Alpine v3.10 | sudo | 1.8.27-r1 | — |
| Alpine v3.9 | sudo | 1.8.25_p1-r3 | — |
| Alpine v3.8 | sudo | 1.8.23-r3 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | sudo +1 | 1.8.23-4.amzn2.0.1 | ALAS2-2019-1315 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | sudo | 1.8.25p1-4.0.1.el8_0.1 | ELSA-2019-4822, ELSA-2019-3694 |
| Oracle Linux 7 | sudo +1 | 1.8.23-4.0.1.el7 | ELSA-2019-4821 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- sudo 1.8.27 - Security Bypass EDB-47502 · local · Oct 15, 2019
GitHub 27 repositories · most starred shown
-
n0w4n/CVE-2019-14287 ★ 13 · Oct 15, 2019
Sudo exploit
-
CMNatic/Dockerized-CVE-2019-14287 ★ 7 · Feb 9, 2020
Containerized and deployable use of the CVE-2019-14287 vuln. View README.md for more.
-
shallvhack/Sudo-Security-Bypass-CVE-2019-14287 ★ 3 · Oct 18, 2019
Sudo Security Bypass (CVE-2019-14287)
-
MariliaMeira/CVE-2019-14287 ★ 1 · Oct 12, 2022
-
FauxFaux/sudo-cve-2019-14287 ★ 1 · Oct 15, 2019
-
CashWilliams/CVE-2019-14287-demo ★ 1 · Oct 15, 2019
This is a container built for demonstration purposes that has a version of the sudo command which is vulnerable to CVE-2019-14287
-
Sindadziy/cve-2019-14287 ★ 0 · Nov 12, 2019
-
wenyu1999/sudo- ★ 0 · Nov 11, 2019
cve-2019-14287
-
huang919/cve-2019-14287-PPT ★ 0 · Oct 28, 2019
-
gurneesh/CVE-2019-14287-write-up ★ 0 · Oct 16, 2019
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 28
- USN-4154-1 sudo vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- RHSA-2020:0388 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:4191 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:3895 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:3754 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:3755 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:3694 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:3278 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:3219 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:3209 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:3205 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:3204 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:3197 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHBA-2019:3248 Red Hat Bug Fix Advisory: redhat-virtualization-host security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-4543-1 sudo - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1964-1 sudo - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2019:2667-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14193-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2668-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2666-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2333-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2316-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11413-1 sudo-1.9.7p2-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2656-1 Security update for sudo SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2019-3694 Important: sudo security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 22, 2019
- ELSA-2019-4822 Important: sudo security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 15, 2019
- ELSA-2019-4821 Important: sudo security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 15, 2019
- ALAS2-2019-1315 Important: sudo security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 14, 2019
References
- [oss-security] 20191014 Sudo: CVE-2019-14287 mailing-list
- USN-4154-1 vendor-advisory
- DSA-4543 vendor-advisory
- 20191015 [SECURITY] [DSA 4543-1] sudo security update mailing-list
- 20191015 [slackware-security] sudo (SSA:2019-287-01) mailing-list
- openSUSE-SU-2019:2316 vendor-advisory
- http://packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.html
- FEDORA-2019-9cb221f2be vendor-advisory
- https://www.sudo.ws/alerts/minus_1_uid.html
- openSUSE-SU-2019:2333 vendor-advisory
- https://security.netapp.com/advisory/ntap-20191017-0003/
- [oss-security] 20191015 Re: Sudo: CVE-2019-14287 mailing-list
- [debian-lts-announce] 20191017 [SECURITY] [DLA 1964-1] sudo security update mailing-list
- FEDORA-2019-67998e9f7e vendor-advisory
- https://support.f5.com/csp/article/K53746212?utm_source=f5support&%3Butm_medium=RSS
- [oss-security] 20191023 Membership application for linux-distros - VMware mailing-list
- RHSA-2019:3197 vendor-advisory
- RHSA-2019:3205 vendor-advisory
- RHSA-2019:3204 vendor-advisory
- RHSA-2019:3209 vendor-advisory
- RHSA-2019:3219 vendor-advisory
- [oss-security] 20191029 Re: Membership application for linux-distros - VMware mailing-list
- FEDORA-2019-72755db9c7 vendor-advisory
- RHSA-2019:3278 vendor-advisory
- https://resources.whitesourcesoftware.com/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287
- RHSA-2019:3694 vendor-advisory
- RHSA-2019:3755 vendor-advisory
- RHSA-2019:3754 vendor-advisory
- RHSA-2019:3895 vendor-advisory
- RHSA-2019:3916 vendor-advisory
- RHBA-2019:3248 vendor-advisory
- RHSA-2019:3941 vendor-advisory
- RHSA-2019:4191 vendor-advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03976en_us
- RHSA-2020:0388 vendor-advisory
- GLSA-202003-12 vendor-advisory
- [oss-security] 20210914 Re: Oracle Solaris membership in the distros list mailing-list