Lucene search

K
mageiaGentoo FoundationMGASA-2020-0246
HistoryJun 11, 2020 - 1:26 a.m.

Updated sudo packages fix security vulnerability

2020-06-1101:26:12
Gentoo Foundation
advisories.mageia.org
13

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.008 Low

EPSS

Percentile

81.2%

Updated sudo packages fix security vulnerabilities: It was found that sudo always allowed commands to be run with unknown user or group ids if the sudo configuration allowed it for example via the โ€œALLโ€ alias. This could allow sudo to impersonate non-existent account and depending on how applications are configured, could lead to certain restriction bypass. This is now explicitly disabled. A new setting called โ€œallow_unknown_runas_idโ€ was introduced in order to enable this (CVE-2019-19232). When an account is disabled via the shadow file, by replacing the password hash with โ€œ!โ€, it is not considered disabled by sudo. And depending on the configuration, sudo can be run by using such disabled account (CVE-2019-19234). The sudo package has been updated to version 1.8.31p1, fixing these issues and other bugs.

OSVersionArchitecturePackageVersionFilename
Mageia7noarchsudo<ย 1.8.31p1-1.1sudo-1.8.31p1-1.1.mga7

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.008 Low

EPSS

Percentile

81.2%