CVE-2019-19232

Name	CVE-2019-19232
Description	In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	947225

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
sudo (PTS)	jessie, jessie (lts)	1.8.10p3-1+deb8u9	vulnerable
	stretch (security)	1.8.19p1-2.1+deb9u3	vulnerable
	stretch (lts), stretch	1.8.19p1-2.1+deb9u6	vulnerable
	buster (security), buster, buster (lts)	1.8.27-1+deb10u6	vulnerable
	bullseye (security), bullseye	1.9.5p2-3+deb11u1	fixed
	bookworm	1.9.13p3-1+deb12u1	fixed
	sid, trixie	1.9.16p1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
sudo	source	(unstable)	1.8.31-1	unimportant		947225

Notes

https://www.sudo.ws/devel.html#1.8.30b2
Sudo 1.8.30 introduces an option to enable/disable the behavior.
[wheezy] - sudo <no-dsa> (Minor issue, requires Runas ALL access)