CVE-2019-14868

ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection

Loading…

Severity

Important

Red Hat Product Security

7.4

CVSS 3.1

Review impact separately from score.

Published · December 13, 2019

Updated · November 22, 2025

Description

A flaw was found in the way ksh evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No known mitigation available.

CVSS / CWE

CVSS 3.1 · 7.4
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')