Important: sudo security update
Summary
ALSA-2023:0282: Important: sudo security update. Affects sudo versions < 1.9.5p2-7.el9_1.1. Fixed in 1.9.5p2-7.el9_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sudo package is a utility that allows system administrators to grant certain users the ability to execute privileged commands without logging in as root. It is used for system management purposes. The vulnerability in sudo allows arbitrary file write with the privileges of the RunAs user.
Vulnerability Detail
The sudo vulnerability (CVE-2023-22809) allows an attacker to write arbitrary files with the privileges of the RunAs user. This can lead to unauthorized modification of critical system files or the execution of malicious code.
How To Fix
Minimum fixed version
1.9.5p2-7.el9_1.1
This is the first release that contains the fix.
sudo dnf update sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the security update as soon as possible.
Conclusion
It is important to update the sudo package to the latest version to mitigate the risk of arbitrary file write vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for sudo →
FAQ
Sudo is a utility that allows system administrators to grant certain users the ability to execute privileged commands without logging in as root.
The vulnerability allows an attacker to write arbitrary files with the privileges of the RunAs user, potentially leading to unauthorized modification of critical system files or the execution of malicious code.
To fix this vulnerability, update the sudo package to version 1.9.5p2-7.el9_1.1 or later using the package manager update command specific to your operating system.
There is no known workaround for this vulnerability. It is crucial to apply the security update as soon as possible.
You can find more information about this vulnerability, including the impact and CVSS score, on the CVE page listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
