Red Hat Security AdvisoryRHSA-2019:3755
sudo security update
Released 2019-11-06 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) sudo-1.8.6p3-29.el6_10.2
- Red Hat Enterprise Linux Desktop Optional (v. 6) sudo-devel-1.8.6p3-29.el6_10.2
- Red Hat Enterprise Linux HPC Node (v. 6) sudo-1.8.6p3-29.el6_10.2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) sudo-devel-1.8.6p3-29.el6_10.2
- Red Hat Enterprise Linux Server (v. 6) sudo-1.8.6p3-29.el6_10.2
- Red Hat Enterprise Linux Server Optional (v. 6) sudo-devel-1.8.6p3-29.el6_10.2, sudo-devel-1.8.6p3-29.el6_10.2.ppc
- Red Hat Enterprise Linux Workstation (v. 6) sudo-1.8.6p3-29.el6_10.2
- Red Hat Enterprise Linux Workstation Optional (v. 6) sudo-devel-1.8.6p3-29.el6_10.2
Fixes 1 record
Priority HIGH 74
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.63764 · Published 2019-10-17 · Fixed CWE-755
