Red Hat Security AdvisoryRHSA-2019:3197
sudo security update
Released 2019-10-24 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) sudo-1.8.23-4.el7_7.1
- Red Hat Enterprise Linux Client Optional (v. 7) sudo-devel-1.8.23-4.el7_7.1
- Red Hat Enterprise Linux ComputeNode (v. 7) sudo-1.8.23-4.el7_7.1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) sudo-devel-1.8.23-4.el7_7.1
- Red Hat Enterprise Linux Server (v. 7) sudo-1.8.23-4.el7_7.1
- Red Hat Enterprise Linux Server Optional (v. 7) sudo-devel-1.8.23-4.el7_7.1, sudo-devel-1.8.23-4.el7_7.1.ppc
- Red Hat Enterprise Linux Workstation (v. 7) sudo-1.8.23-4.el7_7.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) sudo-devel-1.8.23-4.el7_7.1
Fixes 1 record
Priority HIGH 74
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.63764 · Published 2019-10-17 · Fixed CWE-755
