In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions
    if the authenticating rule allowed the user to execute any command. Rules that only allowed to
    authenticated user to execute specific commands were not affected by this issue. (CVE-2019-25016)

The remote host is affected by the vulnerability described in GLSA-202107-11 (OpenDoas: Insufficient environment filtering)

    OpenDoas does not properly filter the PATH variable from the resulting       shell after escalating privileges.
  Impact :

    A local attacker with control of a user&rsquo;s PATH variable could escalate       privileges if that user uses OpenDoas with a poisoned PATH variable.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
423861	Alpine: multiple doas packages: security update to 6.8-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
423861	Alpine: multiple doas packages: security update to 6.8-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404093	Alpine: doas: security update to 6.6.1-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404093	Alpine: doas: security update to 6.6.1-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404092	Alpine: doas: security update to 6.6.1-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404092	Alpine: doas: security update to 6.6.1-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404091	Alpine: doas: security update to 6.6.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404091	Alpine: doas: security update to 6.6.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
157037	GLSA-202107-11 : OpenDoas: Insufficient environment filtering	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2019-25016

high

Tenable Plugins

high

high

high

high

high

high

high

high

high