CVE-2019-1167 System.Management.Automation subject to bypass via script debugging

What is CVE-2019-1167?

CVE-2019-1167 is a medium-severity vulnerability in Microsoft PowerShell Core, published on 19 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'.

Which versions are affected by CVE-2019-1167?

4 open source packages ship an affected version, including System.Management.Automation. It affects 1 product.

Products include Microsoft Powershell Core.

How do I fix CVE-2019-1167?

Upgrade System.Management.Automation to a fixed version for your release line: 6.1.5 or 6.2.2.

Is CVE-2019-1167 being exploited?

There is no known exploitation of CVE-2019-1167 in the wild and no public exploit code.

Other vulnerabilities in Microsoft PowerShell Core

• CVE-2019-0627 Security feature bypass in PowerShell Core High 7.8
• CVE-2019-0631 Security feature bypass in PowerShell Core High 7.8
• CVE-2019-0632 Security feature bypass in PowerShell Core High 7.8
• CVE-2018-8415 Code injection in PowerShell Core High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5frh-8cmj-gc59.