What’s Vulnerable › Vulnerabilities

CVE-2019-16729

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-24 · updated 2026-06-17

Description

pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root escalation in certain PAM setups.

Affected products

• Canonical Ubuntu Linux: 16.04, 18.04
• Debian Linux: 8.0, 9.0, 10.0
• Pam-Python Project Pam-Python: before 1.0.7-1 — fixed in 1.0.7-1

How to fix

Upgrade to a fixed version: Pam-Python Project Pam-Python 1.0.7-1. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=1150510#c1
• https://lists.debian.org/debian-lts-announce/2019/11/msg00020.html
• https://sourceforge.net/p/pam-python/code/ci/0247ab687b4347cc52859ca461fb0126dd7e2ebe/
• https://tracker.debian.org/news/1066790/accepted-pam-python-107-1-source-amd64-all-into-unstable/
• https://usn.ubuntu.com/4552-1/
• https://usn.ubuntu.com/4552-2/
• https://www.debian.org/security/2019/dsa-4555
• https://bugzilla.suse.com/show_bug.cgi?id=1150510#c1
• https://lists.debian.org/debian-lts-announce/2019/11/msg00020.html
• https://sourceforge.net/p/pam-python/code/ci/0247ab687b4347cc52859ca461fb0126dd7e2ebe/
• https://tracker.debian.org/news/1066790/accepted-pam-python-107-1-source-amd64-all-into-unstable/
• https://usn.ubuntu.com/4552-1/

Get alerted when CVE-2019-16729 or the next vulnerability affects your stack