high8.8
CVE-2019-15901
An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD.
Impact
An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change the UID, primary GID, and secondary GIDs was replaced (on certain platforms: Linux and possibly NetBSD) with a single setuid(2) call. This resulted in neither changing the group id nor initializing secondary group ids.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Doas Project | Doas | before 6.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/slicer69/doas/commit/6cf0236184ff6304bf5e267ccf7ef02874069697
- https://github.com/slicer69/doas/compare/6.1p1...6.2
- https://github.com/slicer69/doas/pull/23
- https://github.com/slicer69/doas/commit/6cf0236184ff6304bf5e267ccf7ef02874069697
- https://github.com/slicer69/doas/compare/6.1p1...6.2
- https://github.com/slicer69/doas/pull/23