Alerts This Week
Warning Icon 1 631
Alerts This Week
Warning Icon 1 631

SUSE: 2019:2668-1 Important: Sudo Privilege Escalation Fix

suse
Calendar Grey October 15, 2019
Dist Suse Esm H88
SUSE Security Patch addresses sudo vulnerabilities with critical enhancements and modifications. Remain protected and aware with these updates.
An update that solves one vulnerability and has three fixes is now available

Summary

This update for sudo provides the following fix: Security issue fixed: - CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674). Other issues fixed: - Cache resolved group names as calling getgrgid() is expensive and on systems connected to AD with many users, groups or sudo rules it causes sudo to take a long time to run (bsc#1068003). - Disable insults by default at build time. For new installations this was done via sudoers file, but when upgrading from previous versions it would accidentally be enabled (bsc#1053911). - Enable support for zlib compressed I/O logs (bsc#1058297). Patch Instructions:

References

#1053911 #1058297 #1068003 #1153674

Cross- CVE-2019-14287

Affected Products:

SUSE Linux Enterprise Server for SAP 12-SP1

SUSE Linux Enterprise Server 12-SP1-LTSS

https://www.suse.com/security/cve/CVE-2019-14287.html

https://bugzilla.suse.com/1053911

https://bugzilla.suse.com/1058297

https://bugzilla.suse.com/1068003

https://bugzilla.suse.com/1153674

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2019:2668-1
Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here