Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Gentoo: GLSA-202301-15 Critical: OpenSSL Remote Code Execution Risk

gentoo
Calendar Grey November 21, 2022
Dist Gentoo Esm H88
An issue within sudo leads to a denial of service impacting users on Gentoo Linux, necessitating an urgent update.
A vulnerability has been discovered in sudo which could result in denial of service.

Summary

In certain password input handling, sudo incorrectly assumes the password input is at least nine bytes in size, leading to a heap buffer overread.

Topics%20covered

Topics Covered

security advisory denial of service gentoo normal severity sudo update heap overread

Resolution

All sudo users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.9.12-r1"

References

[ 1 ] CVE-2022-43995 https://nvd.nist.gov/vuln/detail/CVE-2022-43995

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202211-08
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
critical
Lowest
Low
Medium
High
Critical

Severity: Normal
Title: sudo: Heap-Based Buffer Overread
Date: November 22, 2022
Bugs: #879209
ID: 202211-08

Topics%20covered

Topics Covered

security advisory denial of service gentoo normal severity sudo update heap overread

Synopsis

A vulnerability has been discovered in sudo which could result in denial of service.

Background

sudo allows a system administrator to give users the ability to run commands as other users.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/sudo < 1.9.12-r1 >= 1.9.12-r1

Impact

===== In the worst case, the heap buffer overread can result in the denial of service of the sudo process.

Workaround

There is no known workaround at this time.

Your message here