Summary
RHEL 9.3.0.Z ERRATUM
[1.9.5p2-10]
- CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
Resolves: RHEL-21834
- CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
Resolves: RHEL-21828
- CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables
Resolves: RHEL-21821
RHEL 8.9.0.Z ERRATUM
[1.9.5p2-1]
- Rebase to 1.9.5p2
- CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
Resolves: RHEL-21825
- CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
Resolves: RHEL-21831
- CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables
Resolves: RHEL-21820
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | sudo | 0:1.9.5p2-10.el9_3 |
| Oracle Linux · 8 | sudo-python-plugin | 0:1.9.5p2-10.el9_3 |
Vulnerabilities 3
-
Unscored —
Sudo before 1.9.13 does not escape control characters in log messages.
-
Unscored —
Sudo before 1.9.13 does not escape control characters in sudoreplay output.
-
Unscored —
Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because applicati…