Vulnerability Description
An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Doas Project | Doas | < 6.2 |
Related Weaknesses (CWE)
References
- https://github.com/slicer69/doas/commit/2f83222829448e5bc4c9391d607ec265a1e06531Patch
- https://github.com/slicer69/doas/compare/6.1p1...6.2Release Notes
- https://github.com/slicer69/doas/commit/2f83222829448e5bc4c9391d607ec265a1e06531Patch
- https://github.com/slicer69/doas/compare/6.1p1...6.2Release Notes
FAQ
What is CVE-2019-15900?
CVE-2019-15900 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitiali...
How severe is CVE-2019-15900?
CVE-2019-15900 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-15900?
Check the references section above for vendor advisories and patch information. Affected products include: Doas Project Doas.