Red Hat Security AdvisoryRHSA-2019:3278
sudo security update
Released 2019-10-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server AUS (v. 7.2) sudo-1.8.6p7-17.el7_2.2
- Red Hat Enterprise Linux Server E4S (v. 7.2) sudo-1.8.6p7-17.el7_2.2
- Red Hat Enterprise Linux Server Optional AUS (v. 7.2) sudo-devel-1.8.6p7-17.el7_2.2
- Red Hat Enterprise Linux Server Optional E4S (v. 7.2) sudo-devel-1.8.6p7-17.el7_2.2
- Red Hat Enterprise Linux Server Optional TUS (v. 7.2) sudo-devel-1.8.6p7-17.el7_2.2
- Red Hat Enterprise Linux Server TUS (v. 7.2) sudo-1.8.6p7-17.el7_2.2
Fixes 1 record
Priority HIGH 74
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.63764 · Published 2019-10-17 · Fixed CWE-755
