Summary
The sudo packages contain the sudo utility which allows system
administrators to provide certain users with the permission to execute
privileged commands, which are used for system management purposes, without
having to log in as root.
Bug Fix(es) and Enhancement(s):
* CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
* CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
* CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | sudo | 1.9.5p2-10.el9_3 |
| AlmaLinux · 9 | sudo-python-plugin | 1.9.5p2-10.el9_3 |
Vulnerabilities 3
-
Unscored —
Sudo before 1.9.13 does not escape control characters in log messages.
-
Unscored —
Sudo before 1.9.13 does not escape control characters in sudoreplay output.
-
Unscored —
Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because applicati…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-28486
-
report
https://access.redhat.com/security/cve/CVE-2023-28487
-
report
https://access.redhat.com/security/cve/CVE-2023-42465
-
report
https://bugzilla.redhat.com/2179272
-
report
https://bugzilla.redhat.com/2179273
-
report
https://bugzilla.redhat.com/2255568
-
advisory
https://errata.almalinux.org/9/ALSA-2024-0811.html