CVE-2019-25016

Name of the Vulnerable Software and Affected Versions OpenDoas versions 6.6 through 6.8

Description The issue arises from an incorrect inheritance of the user's PATH variable by authenticated executions in OpenDoas, specifically when the authenticating rule allows the user to execute any command. This does not affect rules that only permit the authenticated user to execute specific commands. There is an unsafe incomplete reset of the PATH variable when changing the user context.

Recommendations For OpenDoas versions 6.6 through 6.8, consider restricting the authenticating rules to only allow execution of specific commands until a fix is available. As a temporary workaround, review and adjust the PATH variable settings to minimize potential risks.