CVE-2019-14868

In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.

• CWE-77
• CWE-77

• http://seclists.org/fulldisclosure/2020/May/53Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14868Issue Tracking, Third Party Advisory
• https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00015.htmlMailing List, Third Party Advisory
• https://support.apple.com/kb/HT211170Third Party Advisory
• http://seclists.org/fulldisclosure/2020/May/53Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14868Issue Tracking, Third Party Advisory
• https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00015.htmlMailing List, Third Party Advisory
• https://support.apple.com/kb/HT211170Third Party Advisory

Published

Apr 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14862There is a vulnerability in knockout before version 3.5.0-be…6.1
• CVE-2019-14863There is a vulnerability in all angular versions before 1.5.…6.1
• CVE-2019-14864Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and…6.5
• CVE-2019-14865A flaw was found in the grub2-set-bootflag utility of grub2.…5.9
• CVE-2019-14866In all versions of cpio before 2.13 does not properly valida…7.3
• CVE-2019-14867A flaw was found in IPA, all 4.6.x versions before 4.6.7, al…8.8
• CVE-2019-14869A flaw was found in all versions of ghostscript 9.x before 9…8.8
• CVE-2019-1487An information disclosure vulnerability in Android Apps usin…6.5
• CVE-2019-14870All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.1…5.4
• CVE-2019-14871The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) …6.5
• CVE-2019-14872The _dtoa_r function of the newlib libc library, prior to ve…6.5
• CVE-2019-14873In the __multadd function of the newlib libc library, prior …6.5