CVEvulnerability

CVE-2019-15900

9.8 CRITICAL Published 2019-10-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-10-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-252, CWE-754, CWE-863, CWE-908

Description

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.

Affected configurations

• doas project doas (< 6.2)

Related

Weakness · CWE (4)

  • CWE-252 Unchecked Return Value weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness
  • CWE-863 Incorrect Authorization weakness
  • CWE-908 Use of Uninitialized Resource weakness

Referenced by CWE · observed example (3)

  • CWE-252 Unchecked Return Value weakness
  • CWE-457 Use of Uninitialized Variable weakness
  • CWE-863 Incorrect Authorization weakness

References