CVE-2019-19234

When an account is disabled via the shadow file, by replacing the password hash with “!”, it is not considered disabled by sudo. And depending on the configuration, sudo can be run by using such disabled account.

Mitigation

This flaw basically allows users which have disabled account in /etc/shadow (password is replaced with '!) to have sudo access. Systems not having such disabled account, or systems disabling sudo access for such accounts using other means (such as not allowing such users to run sudo via access control mechanisms) are not affected by this flaw.