---
title: "CVE-2019-20044\n | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2019-20044?format=md
keywords: index, follow
---
# CVE-2019-20044
Publication date 24 February 2020
Last updated 18 August 2025
---
Ubuntu priority
**Low**
[Why this priority?](https://ubuntu.com/security/cves/about#priority )
## Cvss 3 Severity Score
**7.8 · High**
[Score breakdown](https://ubuntu.com/security/CVE-2019-20044?format=md#impact-score)
Toggle side navigation
## Description
In Zsh before 5.8, attackers able to execute commands can regain privileges
dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved
uid, so the original privileges can be restored by executing
MODULE\_PATH=/dir/with/module zmodload with a module that calls setuid().
[Read the notes from the security team](https://ubuntu.com/security/CVE-2019-20044?format=md#notes)
## Status
Show unmaintained releases
| Package | Ubuntu Release | Status |
| --- | --- | --- |
| zsh | 26.04 LTS resolute | Not affected |
| 25.10 questing | Not affected |
| 25.04 plucky | Not affected |
| 24.10 oracular | Not affected |
| 24.04 LTS noble | Not affected |
| 23.10 mantic | Not affected |
| 23.04 lunar | Not affected |
| 22.10 kinetic | Not affected |
| 22.04 LTS jammy | Needs evaluation |
| 21.10 impish | Not affected |
| 21.04 hirsute | Not affected |
| 20.10 groovy | Not affected |
| 20.04 LTS focal | Not affected |
| 19.10 eoan | Ignored end of life |
| 18.04 LTS bionic | Fixed 5.4.2-3ubuntu3.2 |
| 16.04 LTS xenial | Fixed 5.1.1-1ubuntu2.3+esm1 Ubuntu Pro |
| 14.04 LTS trusty | Not in release |
---
* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2019-20044?format=md#patch-details)
### Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
[Get Ubuntu Pro](https://ubuntu.com/pro)
[30-day free trial](https://ubuntu.com/pro/free-trial)
## Notes
---
### [mdeslaur](https://launchpad.net/~mdeslaur)
reproducer in debian bug
low priority since upstream considers this to be a
"minor vulnerability"
---
### [rodrigo-zaiden](https://launchpad.net/~rodrigo-zaiden)
affects versions prior to 5.8, so only xenial and bionic
needed to be patched.
### Patch details
For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
| Package | Patch details |
| --- | --- |
| zsh | * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: |
## Severity score breakdown
CVSS version:
CVSS v3.0
**Base score**
7.8 · High
* Base metrics
| Parameter | Value |
| --- | --- |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
* Scores
| Parameter | Value |
| --- | --- |
| Base score | 7.8 · High |
| Exploitability score | - |
| Impact score | - |
**Vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
## References
* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20044)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-20044)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2019-20044)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2019-20044)
### Related Ubuntu Security Notices (USN)
+ [USN-5325-1](https://usn.ubuntu.com/USN-5325-1)
+ Zsh vulnerabilities
+ 14 March 2022
### Other references
*
*