Which products and versions are affected by CVE-2019-14287?

Affected: Element Software Management Node (Netapp); Openshift Container Platform (Redhat) versions 4.1; Virtualization (Redhat) versions 4.2, among others. The full list is in the CVE brief.

Is CVE-2019-14287 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2019-14287 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2019-14287?

Public exploit code is available.

How urgently should CVE-2019-14287 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2019-14287

HighPublic exploit

Published Oct 17, 2019 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2019-14287, DEBIAN-CVE-2019-14287, DLA-1964-1, DSA-4543-1, SUSE-SU-2019:14193-1, SUSE-SU-2019:2656-1, SUSE-SU-2019:2666-1, SUSE-SU-2019:2667-1, SUSE-SU-2019:2668-1, UBUNTU-CVE-2019-14287, USN-4154-1

Key Facts

Patch immediately

CVE-2019-14287 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Element Software Management Node (Netapp), Openshift Container Platform (Redhat), Virtualization (Redhat) and 20 more products.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 64% probability of exploitation in the next 30 days.
Fixed versions are available, including redhat-release-virtualization-host 0:4.2-15.1.el7, redhat-virtualization-host 0:4.2-20191022.0.el7_6, rootio-sudo 1.8.27-1.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

64%

Higher than 99.2% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2019-14287 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Affected Products

163 affected entries in total

Product	Affected versions	Fixed in
Element Software Management NodeNetapp	See advisory	n/a
Openshift Container PlatformRedhat	4.1	n/a
VirtualizationRedhat	4.2	n/a
SudoSudo Project	See advisory	1.8.28
Ubuntu LinuxCanonical	12.04, 14.04, 16.04, 18.04, 19.04	n/a

18 more affected products in the full CVE brief

Patched Releases

redhat-release-virtualization-host

0:4.2-15.1.el7

redhat-virtualization-host

0:4.2-20191022.0.el7_6

rootio-sudo

1.8.27-1.1

seal-sudo

1.8.23-10.el7_9.3+sp999

Sudo

0:1.7.2p1-31.el5_11.1, 0:1.8.23-4.el7_7.1, 0:1.8.25p1-8.el8_1, 0:1.8.6p3-15.el6_6.2, 1.7.6p2-0.30.5.1, 1.8.10p3-1+deb8u6, 1.8.10p3-10.23.1, 1.8.10p3-2.28.1, 1.8.16-0ubuntu1.8, 1.8.19p1-2.1+deb9u1, 1.8.20p2-2.ph1, 1.8.20p2-3.14.1, 1.8.20p2-6.ph2, 1.8.21p2-3ubuntu1.1, 1.8.22-4.6.1, 1.8.22-lp150.8.1, 1.8.22-lp151.5.3.1, 1.8.23-10.el7_9.3+sp999, 1.8.23-2.ph3, 1.8.23-4.0.1.el7, 1.8.23-4.amzn2.0.1, 1.8.23-r3, 1.8.25_p1-r3, 1.8.25p1-4.0.1.el8_0.1, 1.8.25p1-8.el8_1, 1.8.27-1.1, 1.8.27-1+deb10u1, 1.8.27-r1, 1.8.28-1, 1.8.28-r0, 1.8.6p3-29.0.1.el6_10.2, 1.8.6p3-29.28.amzn1, 1.8.9p5-1ubuntu1.5+esm2, 1.9.7p2-1.4, 1.8.28

sudo-devel

1.8.20p2-3.14.1, 1.8.22-4.6.1, 1.8.22-lp150.8.1, 1.8.22-lp151.5.3.1, 1.8.23-4.0.1.el7, 1.8.23-4.amzn2.0.1, 1.8.6p3-29.0.1.el6_10.2, 1.8.6p3-29.28.amzn1, 1.9.7p2-1.4

sudo-plugin-python

1.9.7p2-1.4

sudo-test

1.8.22-lp150.8.1, 1.8.22-lp151.5.3.1, 1.9.7p2-1.4

Timeline

Publicly disclosed
Oct 17, 2019
Last updated
Aug 4, 2026

Weakness Type

CWE-267 Privilege Defined With Unsafe Actions
CWE-755 Improper Handling of Exceptional Conditions

References

advisoryopenSUSE-SU-2019:2316
advisoryopenSUSE-SU-2019:2333
advisoryhttp://packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.html
advisoryRHBA-2019:3248
advisoryRHSA-2019:3197

15 more references in the full CVE brief

FAQ

Common Questions.

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID.
Affected: Element Software Management Node (Netapp); Openshift Container Platform (Redhat) versions 4.1; Virtualization (Redhat) versions 4.2, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including redhat-release-virtualization-host 0:4.2-15.1.el7, redhat-virtualization-host 0:4.2-20191022.0.el7_6, rootio-sudo 1.8.27-1.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Is CVE-2019-14287 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.