Red Hat Security AdvisoryRHSA-2019:3205
sudo security update
Released 2019-10-24 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) sudo-1.8.23-3.el7_6.1
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) sudo-devel-1.8.23-3.el7_6.1
- Red Hat Enterprise Linux Server EUS (v. 7.6) sudo-1.8.23-3.el7_6.1
- Red Hat Enterprise Linux Server Optional EUS (v. 7.6) sudo-devel-1.8.23-3.el7_6.1, sudo-devel-1.8.23-3.el7_6.1.ppc
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) sudo-1.8.23-3.el7_6.1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) sudo-devel-1.8.23-3.el7_6.1
Fixes 1 record
Priority HIGH 74
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.63764 · Published 2019-10-17 · Fixed CWE-755
