Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:0408-1

Опубликовано: 19 фев. 2020
Источник: suse-cvrf

Описание

Security update for sudo

This update for sudo fixes the following issues:

Security issue fixed:

  • CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers (bsc#1162202).

Non-security issue fixed:

  • Fixed an issue where sudo -l would ask for a password even though listpw was set to never (bsc#1162675).

Список пакетов

Container ses/6/cephcsi/cephcsi:latest
sudo-1.8.22-4.9.1
Container ses/6/rook/ceph:latest
sudo-1.8.22-4.9.1
Container ses/7/ceph/ceph:latest
sudo-1.8.22-4.9.1
Container ses/7/cephcsi/cephcsi:latest
sudo-1.8.22-4.9.1
Container ses/7/rook/ceph:latest
sudo-1.8.22-4.9.1
Container suse/sle-micro/5.0/toolbox:latest
sudo-1.8.22-4.9.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS
sudo-1.8.22-4.9.1
sudo-devel-1.8.22-4.9.1
SUSE Linux Enterprise High Performance Computing 15-LTSS
sudo-1.8.22-4.9.1
sudo-devel-1.8.22-4.9.1
SUSE Linux Enterprise Module for Basesystem 15
sudo-1.8.22-4.9.1
sudo-devel-1.8.22-4.9.1
SUSE Linux Enterprise Module for Basesystem 15 SP1
sudo-1.8.22-4.9.1
sudo-devel-1.8.22-4.9.1
SUSE Linux Enterprise Server 15-LTSS
sudo-1.8.22-4.9.1
sudo-devel-1.8.22-4.9.1
SUSE Linux Enterprise Server for SAP Applications 15
sudo-1.8.22-4.9.1
sudo-devel-1.8.22-4.9.1

Ссылки

Описание

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

Затронутые продукты
Container ses/6/cephcsi/cephcsi:latest:sudo-1.8.22-4.9.1
Container ses/6/rook/ceph:latest:sudo-1.8.22-4.9.1
Container ses/7/ceph/ceph:latest:sudo-1.8.22-4.9.1
Container ses/7/cephcsi/cephcsi:latest:sudo-1.8.22-4.9.1
Ссылки