High
Security advisory
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-25016
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:29 UTC · Revision 1
Source evidence
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
osv:CVE-2019-25016
Complete source record
{
"id": "58aca4e49f29b5c47cc191284c9633fa2f50de8b95ef4d8cd6729a2dedd412f7",
"url": "https://osv.dev/vulnerability/CVE-2019-25016",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-25016",
"summary": "In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.",
"evidence": "osv:CVE-2019-25016",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-25016",
"aliases": [
"CVE-2019-25016"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/duncaen/opendoas",
"type": "GIT",
"events": [
{
"introduced": "84ce5c7f600aa91f53db656c062ed269765146dd"
},
{
"last_affected": "31abd37c26c26892ce5e0d538c51fbc38ff3e05a"
},
{
"fixed": "01c658f8c45cb92a343be5f32aa6da70b2032168"
},
{
"fixed": "d5acd52e2a15c36a8e06f9103d35622933aa422d"
},
{
"fixed": "24b1a957cbe55363ca06a62b10c936e5c53e3423"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:opendoas_project:opendoas:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.6"
},
{
"last_affected": "6.8"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "01c658f8c45cb92a343be5f32aa6da70b2032168"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d5acd52e2a15c36a8e06f9103d35622933aa422d"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "24b1a957cbe55363ca06a62b10c936e5c53e3423"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v6.8.1"
}
]
}
}
],
"versions": [
"v6.8",
"v6.6.1",
"v6.6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-25016.json",
"vanir_signatures": [
{
"id": "CVE-2019-25016-04ee6c31",
"digest": {
"length": 4308,
"function_hash": "7098330978455536148109103280447537240"
},
"source": "https://github.com/duncaen/opendoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d",
"target": {
"file": "doas.c",
"function": "main"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-25016-1dbd081b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"231007709997070606970432031264988504774"
]
},
"source": "https://github.com/duncaen/opendoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168",
"target": {
"file": "doas.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-25016-2c8ed0c4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"231110764212316461141416984353451739909",
"48441911000450214705815811512521461542",
"151168221494388165766927318223219874647",
"249400151921621738828160597630264960307",
"75344284143316011413155972510703904260",
"107835079014415195767658276799020314599",
"3624704062695225774971047727750443519",
"210902324541330136036704086401647312044",
"12395157652841821889255212881233562243",
"152904917964781074889615999068623345429",
"121619290354750308327406962442542535112",
"201924830262806423905011167628223520240",
"309228072397450860923504480371459819663",
"187481220286621766275240747572787731475",
"250284520816918137950741772928248576543",
"208467881117005140176959003017775131823",
"91773150467752056710322922946048359888",
"170788070311357272796998996708653839945",
"313498383051195508754530838091569028152",
"339977404130653776622835270519146694715",
"150474329929098544001714432674839672679",
"256244181334327505598513019873580600364",
"255142214800660335652924569546819404660",
"50571261654530264816494450194921034954",
"252867978570132254648626344380829943254",
"254856661739382988390247707698747057420",
"152086245846992507187176182062410045549",
"67914587962332430480993194254472678792",
"63804212172144207191189564382493189062",
"145990509849831815130987437565713594383",
"307740484561858907319207558001973381106",
"6983776394035282252805287756591399283",
"176549937264176799156569583778642439029"
]
},
"source": "https://github.com/duncaen/opendoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168",
"target": {
"file": "env.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-25016-2ea24e83",
"digest": {
"length": 5566,
"function_hash": "42908504996377818008225957040937696126"
},
"source": "https://github.com/duncaen/opendoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168",
"target": {
"file": "doas.c",
"function": "main"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-25016-6e88d6dc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82421280381351964465846937784636923593",
"187492228799553088891971297768223607001",
"339133227222824900054163433920920231016",
"203943906308288206055648740558614812237",
"63036852031059749637822516844654605023",
"182413496885526328057083603134424165361",
"197453611604326364852252673376264939524",
"85172692533219297388325506270839739901",
"57672792752139126986797701043401362666"
]
},
"source": "https://github.com/duncaen/opendoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168",
"target": {
"file": "doas.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-25016-7400f127",
"digest": {
"threshold": 0.9,
"line_hashes": [
"162194002426821285644788617706889120027",
"147290946160661880513048956819438232208",
"333992195635180149045190548998442126096",
"203943906308288206055648740558614812237",
"272791045080084209974340772837191315903",
"93886895216760195033355549902898906689",
"135935894908028979400589891588076374315",
"325470285944737631327347462970541281906"
]
},
"source": "https://github.com/duncaen/opendoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d",
"target": {
"file": "doas.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-25016-8abe33d2",
"digest": {
"length": 364,
"function_hash": "289383679655243289808284369618779008913"
},
"source": "https://github.com/duncaen/opendoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168",
"target": {
"file": "env.c",
"function": "prepenv"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-25016-c22b4a1c",
"digest": {
"length": 741,
"function_hash": "164581048558700203767737999635241135344"
},
"source": "https://github.com/duncaen/opendoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168",
"target": {
"file": "env.c",
"function": "createenv"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:43:04Z"
}
}
],
"modified": "2026-10-20T13:43:04.122193953Z",
"provider": "osv",
"references": [
"https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1",
"https://security.gentoo.org/glsa/202107-11",
"https://github.com/Duncaen/OpenDoas/issues/45",
"https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168",
"https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-25016",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387992,
"published_at": "2021-01-28T20:15:12.663+00:00"
}