[Bugs] [Bug 13323] New: [CVE 21] sudo 1.9.8p2 CVEs found

[bugzilla]

https://bugzilla.rosalinux.ru/show_bug.cgi?id=13323

          Platform: 2021.1
            Bug ID: 13323
           Summary: [CVE 21] sudo 1.9.8p2  CVEs found
    Classification: ROSA-based products
           Product: ROSA Fresh
           Version: All
          Hardware: All
               URL: CVE-2022-43995, CVE-2023-22809, CVE-2023-27320,
                    CVE-2023-28486, CVE-2023-28487,
                OS: Linux
            Status: CONFIRMED
          Severity: normal
          Priority: Normal
         Component: System (kernel, glibc, systemd, bash, PAM...)
          Assignee: bugs на lists.rosalinux.ru
          Reporter: y.tumanov на rosalinux.ru
        QA Contact: bugs на lists.rosalinux.ru
                CC: s.matveev на rosalinux.ru, y.tumanov на rosalinux.ru
  Target Milestone: ---
             Flags: secteam_verified?

Please patch CVEs for package sudo version 1.9.8p2

INFO (CVEs are): sudo 1.9.8p2
 cves found
CVE-2022-43995
Desc: Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a
plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a
heap-based buffer over-read. This can be triggered by arbitrary local users
with access to Sudo by entering a password of seven characters or fewer. The
impact could vary depending on the system libraries, compiler, and processor
architecture.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-43995
Severity: HIGH
CVE-2023-22809
Desc: In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra
arguments passed in the user-provided environment variables (SUDO_EDITOR,
VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to
the list of files to process. This can lead to privilege escalation. Affected
versions are 1.8.0 through 1.9.12.p1. The problem exists because a
user-specified editor may contain a "--" argument that defeats a protection
mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-22809
Severity: HIGH
CVE-2023-27320
Desc: Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-27320
Severity: HIGH
CVE-2023-28486
Desc: Sudo before 1.9.13 does not escape control characters in log messages.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-28486
Severity: MEDIUM
CVE-2023-28487
Desc: Sudo before 1.9.13 does not escape control characters in sudoreplay
output.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-28487
Severity: MEDIUM

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
----------- следущая часть -----------
Вложение в формате HTML было извлечено…
URL: <http://lists.rosalinux.ru/pipermail/bugs/attachments/20230503/3fa361b5/attachment.html>