Описание
Security update for sudo
This update for sudo fixes the following issue:
- CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).
This update was imported from the SUSE:SLE-15:Update update project.
Список пакетов
openSUSE Leap 15.0
sudo-1.8.22-lp150.8.1
sudo-devel-1.8.22-lp150.8.1
sudo-test-1.8.22-lp150.8.1
Ссылки
- E-Mail link for openSUSE-SU-2019:2333-1
- SUSE Security Ratings
- SUSE Bug 1153674
- SUSE CVE CVE-2019-14287 page
Описание
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Затронутые продукты
openSUSE Leap 15.0:sudo-1.8.22-lp150.8.1
openSUSE Leap 15.0:sudo-devel-1.8.22-lp150.8.1
openSUSE Leap 15.0:sudo-test-1.8.22-lp150.8.1
Ссылки
- CVE-2019-14287
- SUSE Bug 1153674
- SUSE Bug 1156093