CVE-2019-14868
- State
- Published
- Severity
- 7.4 High
- Published
- Apr 2, 2020
- Updated
- Aug 5, 2024
- Reserved
- Aug 10, 2019
Description
In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.4 High | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
kshKornShell |
|
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14868
- https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2
- https://support.apple.com/kb/HT211170
- 20200529 APPLE-SA-2020-05-26-3 macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierramailing-list
- [debian-lts-announce] 20200720 [SECURITY] [DLA 2284-1] ksh security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.