CVE-2019-18276

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

• CWE-273
• CWE-273

• http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ffPatch, Third Party Advisory
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
• https://security.gentoo.org/glsa/202105-34Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200430-0003/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.youtube.com/watch?v=-wGtxJ8opa8Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ffPatch, Third Party Advisory
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
• https://security.gentoo.org/glsa/202105-34Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200430-0003/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.youtube.com/watch?v=-wGtxJ8opa8Exploit, Third Party Advisory

Published

Nov 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18267An issue was found in GE S2020/S2020G Fast Switch 61850, S20…5.4
• CVE-2019-18269Omron’s CS and CJ series PLCs have an unrestricted externall…9.8
• CVE-2019-1827A vulnerability in the Online Help web service of Cisco Smal…6.1
• CVE-2019-18271OSIsoft PI Vision, All versions of PI Vision prior to 2019. …8.8
• CVE-2019-18273OSIsoft PI Vision, PI Vision 2017 R2 and PI Vision 2017 R2 S…4.8
• CVE-2019-18275OSIsoft PI Vision, All versions of PI Vision prior to 2019. …6.5
• CVE-2019-18277A flaw was found in HAProxy before 2.0.6. In legacy mode, me…7.5
• CVE-2019-18278When executing VideoLAN VLC media player 3.0.8 with libqt on…7.8
• CVE-2019-18279In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the inclu…8.8
• CVE-2019-1828A vulnerability in the web-based management interface of Cis…5.9
• CVE-2019-18280Sourcecodester Online Grading System 1.0 is affected by a Cr…8.8
• CVE-2019-18281An out-of-bounds memory access in the generateDirectionalRun…4.3