Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-42465: Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | sudo | 0:1.9.14-1.p3.amzn2023.0.1 |
| Amazon Linux · 2023 | sudo-debuginfo | 0:1.9.14-1.p3.amzn2023.0.1 |
| Amazon Linux · 2023 | sudo-debugsource | 0:1.9.14-1.p3.amzn2023.0.1 |
| Amazon Linux · 2023 | sudo-devel | 0:1.9.14-1.p3.amzn2023.0.1 |
| Amazon Linux · 2023 | sudo-logsrvd | 0:1.9.14-1.p3.amzn2023.0.1 |
| Amazon Linux · 2023 | sudo-logsrvd-debuginfo | 0:1.9.14-1.p3.amzn2023.0.1 |
| Amazon Linux · 2023 | sudo-python-plugin | 0:1.9.14-1.p3.amzn2023.0.1 |
| Amazon Linux · 2023 | sudo-python-plugin-debuginfo | 0:1.9.14-1.p3.amzn2023.0.1 |
Vulnerabilities 1
-
Unscored —
Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because applicati…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-42465.html