Skip to content
OpenAdvisories
High ELSA-2019-4821 1 CVE

Important: sudo security update (Oracle Linux 7)

Published Oct 15, 2019 · Updated Oct 15, 2019

Ecosystem: Oracle Linux

Summary

[1.8.23-4.0.1]
- Treat an ID of -1 as invalid since that means 'no change' [Orabug: 30421281] {CVE-2019-14287}
- Add sudo_strtoid() tests for -1 and range errors. [Orabug: 30421281]

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 7 sudo 0:1.8.23-4.0.1.el7
Oracle Linux · 7 sudo-devel 0:1.8.23-4.0.1.el7

Vulnerabilities 1

  • Unscored —
    CVE-2019-14287 Public exploit EPSS 64%

    In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and s…

    sudo sudo sudo Debian Ubuntu Alpine