sudo-1.8.29-5.el8
エラータID: AXSA:2020-308:05
リリース日:
2020/09/09 Wednesday - 04:37
題名:
sudo-1.8.29-5.el8
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- sudo には、runas ALL sudoer アカウントを持つ攻撃者が、どのユーザアカウントに
紐付けられていない UID の数値を用いて sudo を実行することで、存在しないユーザに
なりすますことの可能な脆弱性があります。(CVE-2019-19232)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2019-19232
** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions.
** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions.
追加情報:
N/A
ダウンロード:
SRPMS
- sudo-1.8.29-5.el8.src.rpm
MD5: 969559bfb29da9130bcaf4ad3bcd4661
SHA-256: 88e299eb07b82a0067c01407ae0470f21acae4259232c98b4db79bc9bca9e482
Size: 3.24 MB
Asianux Server 8 for x86_64
- sudo-1.8.29-5.el8.x86_64.rpm
MD5: 28dc97125279352eaeee7a4672179b8e
SHA-256: 917a85d6c65dbc0c147419736e8de5e44c9facba2efe63755d5ca0fb1f6d1f8f
Size: 925.85 kB
English