Red Hat Security AdvisoryRHSA-2020:1804
sudo security, bug fix, and enhancement update
Released 2020-04-28 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux BaseOS (v. 8) sudo-1.8.29-5.el8
Fixes 2 records
Priority LOW 39
In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer a…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0317 · Published 2019-12-19 · Partial fix
Priority LOW 39
In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03295 · Published 2019-12-19 · Partial fix
