ALAS2-2023-2301 — Moderate: sudo security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28487: Sudo before 1.9.13 does not escape control characters in sudoreplay output. CVE-2023-28486: Sudo before 1.9.13 does not escape control characters in log messages.

Fixed packages 3

Release	Package	Fixed in
Amazon Linux · 2	sudo	0:1.8.23-10.amzn2.3.5
Amazon Linux · 2	sudo-debuginfo	0:1.8.23-10.amzn2.3.5
Amazon Linux · 2	sudo-devel	0:1.8.23-10.amzn2.3.5

Vulnerabilities 2

Unscored —

CVE-2023-28486

Sudo before 1.9.13 does not escape control characters in log messages.

sudo sudo Debian Ubuntu

Mar 16, 2023
Unscored —

CVE-2023-28487

Sudo before 1.9.13 does not escape control characters in sudoreplay output.

sudo sudo Debian Ubuntu

Mar 16, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-28486.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-28487.html