PatchTheCVECVE-2019-19232: In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent us
CVE-2019-19232 is a high-severity flaw (CVSS 7.5) affecting sudo. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 3.3% (top 12%) |
| CISA exploited list | No |
| Published | 2019-12-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-19232?
sudo: upgrade to newer than 1.8.29. Exact commands for each OS are on this page.
Is CVE-2019-19232 being exploited?
CVE-2019-19232 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-19232 affect?
CVE-2019-19232 affects sudo. Severity is high (CVSS 7.5). In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is n
How urgent is CVE-2019-19232?
Priority 53/100. High severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-35535 HIGH 7.4 UPGRADE UPGRADE In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege
- CVE-2025-32462 LOW 2.8 UPGRADE Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor
- CVE-2025-46718 LOW 3.3 UPGRADE sudo-rs is a memory safe implementation of sudo and su written in Rust
- CVE-2025-46717 LOW 3.3 UPGRADE sudo-rs is a memory safe implementation of sudo and su written in Rust
- CVE-2025-32463 CRITICAL 9.3 EXPLOITED UPGRADE MITIGATE Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability