What’s Vulnerable › Vulnerabilities

CVE-2019-25016

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-01-28 · updated 2026-06-17
• Weakness: CWE-459

Description

In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.

Affected products

• Opendoas Project Opendoas: from 6.6 through 6.8

References

• https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168
• https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d
• https://github.com/Duncaen/OpenDoas/issues/45
• https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1
• https://security.gentoo.org/glsa/202107-11
• https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168
• https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d
• https://github.com/Duncaen/OpenDoas/issues/45
• https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1
• https://security.gentoo.org/glsa/202107-11

Get alerted when CVE-2019-25016 or the next vulnerability affects your stack