CVE-2019-25016: opendoas project opendoas

csirt@kutim:~/threat-intel/cve/CVE-2019-25016

CVSS 8.8 · High EPSS 2,7%

Kerentanan Incomplete Cleanup pada opendoas project opendoas. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.

Rincian

Terbit di NVD: 28 Januari 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-459: Incomplete Cleanup
CWE-909: Missing Initialization of Resource
EPSS (30 hari): 2,7% peluang dieksploitasi; lebih tinggi dari 85,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
opendoas project	opendoas	Versi 6.6 hingga 6.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168 patch · advisory pihak ketiga
https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d patch · advisory pihak ketiga
https://github.com/Duncaen/OpenDoas/issues/45 exploit · issue tracking · advisory pihak ketiga
https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1 release notes · advisory pihak ketiga
https://security.gentoo.org/glsa/202107-11 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.