sudo-1.8.29-8.el8.1

エラータID: AXSA:2023-4844:01

Release date: 
Tuesday, January 24, 2023 - 01:02
Subject: 
sudo-1.8.29-8.el8.1
Affected Channels: 
Asianux Server 8 for x86_64
Severity: 
High
Description: 

The sudo packages contain the sudo utility which allows system administrators to
provide certain users with the permission to execute privileged commands, which
are used for system management purposes, without having to log in as root.

Security Fix(es):

* sudo: arbitrary file write with privileges of the RunAs user
(CVE-2023-22809)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2023-22809
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra
arguments passed in the user-provided environment variables (SUDO_EDITOR,
VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to
the list of files to process. This can lead to privilege escalation. Affected
versions are 1.8.0 through 1.9.12.p1. The problem exists because a
user-specified editor may contain a "--" argument that defeats a protection
mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. sudo-1.8.29-8.el8.1.src.rpm
    MD5: d5957d039fc5a81beb66f29dbfbf7cd0
    SHA-256: dc98d19e7ffacfd198efa9e0a5cdd63be5904092f85a6ea5d52f7f3706f51c26
    Size: 3.27 MB

Asianux Server 8 for x86_64
  1. sudo-1.8.29-8.el8.1.x86_64.rpm
    MD5: 20ca84b6fa325c9375703e31df81949c
    SHA-256: 31573715f2b302295357bec40f9610cc1f613590d73ec7afbfc49f3b51c1ec05
    Size: 924.39 kB