CVE-2023-28487
Sudo before 1.9.13 does not escape control characters in sudoreplay output.
- Update to 1.8.31-1ubuntu1.5
Published Updated
PatchFirst · Latest vulnerabilities
sudo vulnerabilities
Vulnerabilities published for sudo in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 7
CVE-2023-28486
Sudo before 1.9.13 does not escape control characters in log messages.
- Update to 1.8.31-1ubuntu1.5
Published UpdatedCVE-2023-22809
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
- Update to 1.8.31-1ubuntu1.4
Published UpdatedCVE-2021-3156
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
- Update to 1.8.31-1ubuntu1.2
Published UpdatedCVE-2021-23239
The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.
- Update to 1.8.31-1ubuntu1.2
Published UpdatedCVE-2019-19232
In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions
- Update to 1.8.31-1ubuntu1
Published UpdatedCVE-2019-19234
In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ acce
- Update to 1.8.31-1ubuntu1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.