CVE-2019-25016

Name	CVE-2019-25016
Description	In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
doas (PTS)	bullseye	6.8.1-2	fixed
	bookworm, sid	6.8.1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
doas	source	(unstable)	(not affected)

Notes

- doas <not-affected> (Fixed with initial upload to Debian)
Introduced in: https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168 (v6.6)
Fixed by: https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d (v6.8.1)
https://github.com/Duncaen/OpenDoas/issues/45