Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

Mageia 8: 2023-0025 Critical: Sudo Privilege Escalation

mageia
Calendar Grey January 24, 2023
Dist Mageia Esm H88
Recent updates to the sudo packages in Mageia address a vulnerability that could lead to privilege escalation caused by improper handling of environment variables.
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a lo...

Summary

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. (CVE-2023-22809)

References

- https://bugs.mageia.org/show_bug.cgi?id=31437

- - https://lists.debian.org/debian-security-announce/2023/msg00010.html

- https://ubuntu.com/security/notices/USN-5811-1

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/

- https://www.cve.org/CVERecord?id=CVE-2023-22809

Topics%20covered

Topics Covered

security advisory privilege escalation environment variable Mageia sudopackages sudoedit

Resolution

SRPMS

- 8/core/sudo-1.9.5p2-2.2.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 24 Jan 2023
URL: https://advisories.mageia.org/MGASA-2023-0025.html
Type: security
CVE: CVE-2023-22809

Topics%20covered

Topics Covered

security advisory privilege escalation environment variable Mageia sudopackages sudoedit

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.