CVE-2019-14287

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer
account can bypass certain policy blacklists and session PAM modules, and
can cause incorrect logging, by invoking sudo with a crafted user ID. For
example, this allows bypass of !root configuration, and USER= logging, for
a “sudo -u #$((0xffffffff))” command.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942322&gt;