diff --git a/CVE-2019-14868.patch b/CVE-2019-14868.patch
new file mode 100644
index 0000000000000000000000000000000000000000..313568ceb6581a10f716887ec94928401e6f9c19
--- /dev/null
+++ b/CVE-2019-14868.patch
@@ -0,0 +1,93 @@
+From 808df797a15d7f363ff8f4ee4249a33876694b4a Mon Sep 17 00:00:00 2001
+From: Kurtis Rader <krader@skepticism.us>
+Date: Thu, 12 Dec 2019 18:46:50 -0800
+Subject: [PATCH] Harden env var imports
+
+---
+ src/cmd/ksh93/sh/arith.c        | 37 +++++++++++++++++++++++++------------
+ src/cmd/ksh93/tests/subshell.sh | 23 +++++++++++++++++++++++
+ 2 files changed, 48 insertions(+), 12 deletions(-)
+
+diff --git a/src/cmd/ksh93/sh/arith.c b/src/cmd/ksh93/sh/arith.c
+index 5ca3fce..53eb45e 100644
+--- a/src/cmd/ksh93/sh/arith.c
++++ b/src/cmd/ksh93/sh/arith.c
+@@ -567,19 +567,32 @@ Sfdouble_t sh_strnum(Shell_t *shp, const char *str, char **ptr, int mode) {
+     char *last;
+ 
+     if (*str == 0) {
+-        if (ptr) *ptr = (char *)str;
+-        return 0;
+-    }
+-    errno = 0;
+-    d = number(str, &last, shp->inarith ? 0 : 10, NULL);
+-    if (*last) {
+-        if (*last != '.' || last[1] != '.') {
+-            d = strval(shp, str, &last, arith, mode);
+-            Varsubscript = true;
++        d = 0.0;
++        last = (char *)str;
++    } else {
++        d = number(str, &last, shp->inarith ? 0 : 10, NULL);
++        if (*last && !shp->inarith && sh_isstate(shp, SH_INIT)) {
++            // This call is to handle "base#value" literals if we're importing untrusted env vars.
++            d = number(str, &last, 0, NULL);
++        }
++        if (*last) {
++            if (sh_isstate(shp, SH_INIT)) {
++                // Initializing means importing untrusted env vars. Since the string does not appear
++                // to be a recognized numeric literal give up. We can't safely call strval() since
++                // that allows arbitrary expressions which would create a security vulnerability.
++                d = 0.0;
++            } else {
++                if (*last != '.' || last[1] != '.') {
++                    d = strval(shp, str, &last, arith, mode);
++                    Varsubscript = true;
++                }
++                if (!ptr && *last && mode > 0) {
++                    errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str);
++                }
++            }
++        } else if (d == 0.0 && *str == '-') {
++            d = -0.0;
+         }
+-        if (!ptr && *last && mode > 0) errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str);
+-    } else if (!d && *str == '-') {
+-        d = -0.0;
+     }
+     if (ptr) *ptr = last;
+     return d;
+diff --git a/src/cmd/ksh93/tests/subshell.sh b/src/cmd/ksh93/tests/subshell.sh
+index b63a805..3faba47 100644
+--- a/src/cmd/ksh93/tests/subshell.sh
++++ b/src/cmd/ksh93/tests/subshell.sh
+@@ -856,3 +856,26 @@ for exp in 65535 65536
+ do    got=$($SHELL -c 'x=$(printf "%.*c" '$exp' x); print ${#x}' 2>&1)
+     [[ $got == $exp ]] || log_error "large command substitution failed" "$exp" "$got"
+ done
++
++# ==========
++# Verify that importing untrusted env vars does not allow evaluating arbitrary expressions but does
++# recognize all integer literals recognized by ksh.
++expect=8
++actual=$(env SHLVL='7' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "decimal int literal not recognized" "$expect" "$actual"
++
++expect=14
++actual=$(env SHLVL='013' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "leading zeros int literal not recognized" "$expect" "$actual"
++
++expect=4
++actual=$(env SHLVL='2#11' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual"
++
++expect=12
++actual=$(env SHLVL='16#B' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual"
++
++expect=1
++actual=$(env SHLVL="2#11+x[\$($bin_echo DANGER WILL ROBINSON >&2)0]" $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "expression allowed on env var import" "$expect" "$actual"
+-- 
+1.8.3.1
+
diff --git a/ksh.spec b/ksh.spec
index 4f36ecbd36fdae267ae3e898286bbcdb38013b05..4163a81fcf17d9b8555fb4fd1d0a4680bdece2f7 100644
--- a/ksh.spec
+++ b/ksh.spec
@@ -1,6 +1,6 @@
 Name:             ksh
 Version:          2020.0.0
-Release:          2
+Release:          3
 Summary:          The Original ATT Korn Shell
 License:          EPL
 URL:              http://www.kornshell.com/
@@ -9,6 +9,9 @@ Source0:          https://github.com/att/ast/releases/download/%{version}-beta1/
 Source1:          kshcomp.conf
 Source2:          kshrc.rhs
 Source3:          dotkshrc
+
+Patch1:           CVE-2019-14868.patch
+
 Provides:         /bin/ksh /usr/bin/ksh
 BuildRequires:    meson gcc glibc-devel ed
 Conflicts:        pdksh
@@ -26,7 +29,7 @@ Summary:          Documentation for ksh package
 Documentation for ksh package.
 
 %prep
-%autosetup -n %{name}-%{version}-beta1
+%autosetup -p1 -n %{name}-%{version}-beta1
 
 %build
 %meson -Dbuild-api-tests=false
@@ -87,6 +90,12 @@ done
 %{_mandir}/man1/*
 
 %changelog
+* Tue Apr 21 2020 openEuler Buildteam <buildteam@openeuler.org> - 1:2020.0.0-3
+- Type:cves
+- ID:CVE-2019-14868
+- SUG:restart
+- DESC:fix CVE-2019-14868
+
 * Fri Jan 10 2020 Lijin Yang <yanglijin@huawei.com> - 1:2020.0.0-2
 - Package init