Bug 31437 - sudo new security issue CVE-2023-22809
Summary: sudo new security issue CVE-2023-22809
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2023-01-20 17:14 CET by David Walser
Modified: 2023-01-24 09:00 CET (History)
4 users (show)

See Also:
Source RPM: sudo-1.9.5p2-2.1.mga8.src.rpm
CVE: CVE-2023-22809
Status comment:


Attachments

Description David Walser 2023-01-20 17:14:51 CET
Sudo has issued an advisory on January 18:
https://www.sudo.ws/security/advisories/sudoedit_any/

The issue is fixed upstream in 1.9.12p2 (Cauldron has been updated):
https://www.sudo.ws/releases/stable/#1.9.12p2
David Walser 2023-01-20 17:15:02 CET

Status comment: (none) => Fixed upstream in 1.9.12p2

Comment 1 David Walser 2023-01-20 17:26:12 CET
Debian and Ubuntu have issued advisories for this on January 18:
https://www.debian.org/security/2023/dsa-5321
https://ubuntu.com/security/notices/USN-5811-1
Comment 2 Lewis Smith 2023-01-20 20:10:16 CET
For the M8 bit, assigning this globally as 'sudo' has no obvious maintainer.

Assignee: bugsquad => pkg-bugs

Comment 3 Nicolas Salguero 2023-01-23 10:08:58 CET
Suggested advisory:
========================

The updated packages fix a security vulnerability:

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. (CVE-2023-22809)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22809
https://www.sudo.ws/security/advisories/sudoedit_any/
https://www.debian.org/security/2023/dsa-5321
https://ubuntu.com/security/notices/USN-5811-1
========================

Updated packages in core/updates_testing:
========================
sudo-1.9.5p2-2.2.mga8
sudo-devel-1.9.5p2-2.2.mga8

from SRPM:
sudo-1.9.5p2-2.2.mga8.src.rpm

Status comment: Fixed upstream in 1.9.12p2 => (none)
Assignee: pkg-bugs => qa-bugs
CVE: (none) => CVE-2023-22809
CC: (none) => nicolas.salguero
Status: NEW => ASSIGNED

Comment 4 Morgan Leijström 2023-01-23 18:37:11 CET
mga8-64 OK simple test.
Just to execute some commands as root using my user crentials

CC: (none) => fri

Comment 5 David Walser 2023-01-23 22:23:10 CET
Fedora has issued an advisory for this on January 22:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/

Severity: normal => critical

Comment 6 Dave Hodgins 2023-01-24 03:23:27 CET
No regressions noticed in my testing. Advisory committed to svn. Validating.

Keywords: (none) => advisory, validated_update
Whiteboard: (none) => MGA8-64-OK
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 7 Mageia Robot 2023-01-24 09:00:56 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0025.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.