Bug 28067 - sudo new security issues fixed upstream in 1.9.5 (including CVE-2021-23239, CVE-2021-23240)
Summary: sudo new security issues fixed upstream in 1.9.5 (including CVE-2021-23239, C...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-01-11 23:34 CET by David Walser
Modified: 2021-01-17 17:08 CET (History)
6 users (show)

See Also:
Source RPM: sudo-1.8.31p1-1.1.mga7.src.rpm
CVE: CVE-2021-23239, CVE-2021-23240
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2021-01-11 23:34:13 CET 
Sudo 1.9.5 has been released today (January 11):
https://www.sudo.ws/stable.html

Some issues were detailed here:
https://www.openwall.com/lists/oss-security/2021/01/11/2

but there were also others.  We should probably just update it.

Freeze push pending in Cauldron.
Comment 1 Aurelien Oudelet 2021-01-12 14:49:17 CET 
Hi, thanks for reporting this.
As there is no maintainer for this package I added the committers in CC.

(Please set the status to 'assigned' if you are working on it)

Assignee: bugsquad => pkg-bugs
CC: (none) => joequant, mageia, ouaurelien

Comment 2 Nicolas Salguero 2021-01-15 09:53:43 CET 
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path. (CVE-2021-23239)

selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable. (CVE-2021-23240)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23239
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23240
https://www.openwall.com/lists/oss-security/2021/01/11/2
https://www.sudo.ws/stable.html
========================

Updated packages in core/updates_testing:
========================
sudo-1.9.5-1.mga7
sudo-devel-1.9.5-1.mga7

from SRPM:
sudo-1.9.5-1.mga7.src.rpm

Assignee: pkg-bugs => qa-bugs
Status: NEW => ASSIGNED
CC: (none) => nicolas.salguero
CVE: (none) => CVE-2021-23239, CVE-2021-23240

Comment 3 Thomas Andrews 2021-01-15 18:59:34 CET 
No installation issues.

Tested for basic functionality. Ran several commands using sudo, some valid some purposely not valid, all performed as expected.

Looks OK. Validating. Advisory in Comment 2.

CC: (none) => andrewsfarm, sysadmin-bugs
Whiteboard: (none) => MGA7-64-OK
Keywords: (none) => validated_update

Comment 4 Aurelien Oudelet 2021-01-17 15:25:29 CET 
Advisory pushed to SVN.

Keywords: (none) => advisory

Comment 5 Mageia Robot 2021-01-17 17:08:42 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0042.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.