ALAS2023-2023-135 — Moderate: sudo security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28487: Sudo before 1.9.13 does not escape control characters in sudoreplay output. CVE-2023-28486: Sudo before 1.9.13 does not escape control characters in log messages.

Fixed packages 8

Release	Package	Fixed in
Amazon Linux · 2023	sudo	0:1.9.13-1.p2.amzn2023.0.1
Amazon Linux · 2023	sudo-debuginfo	0:1.9.13-1.p2.amzn2023.0.1
Amazon Linux · 2023	sudo-debugsource	0:1.9.13-1.p2.amzn2023.0.1
Amazon Linux · 2023	sudo-devel	0:1.9.13-1.p2.amzn2023.0.1
Amazon Linux · 2023	sudo-logsrvd	0:1.9.13-1.p2.amzn2023.0.1
Amazon Linux · 2023	sudo-logsrvd-debuginfo	0:1.9.13-1.p2.amzn2023.0.1
Amazon Linux · 2023	sudo-python-plugin	0:1.9.13-1.p2.amzn2023.0.1
Amazon Linux · 2023	sudo-python-plugin-debuginfo	0:1.9.13-1.p2.amzn2023.0.1

Vulnerabilities 2

Unscored —

CVE-2023-28486

Sudo before 1.9.13 does not escape control characters in log messages.

sudo sudo Debian Ubuntu

Mar 16, 2023
Unscored —

CVE-2023-28487

Sudo before 1.9.13 does not escape control characters in sudoreplay output.

sudo sudo Debian Ubuntu

Mar 16, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-28486.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-28487.html