183 lines
11 KiB
XML
183 lines
11 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
|
<DocumentTitle xml:lang="en">An update for sudo is now available for openEuler-20.03-LTS and openEuler-20.03-LTS-SP1</DocumentTitle>
|
|
<DocumentType>Security Advisory</DocumentType>
|
|
<DocumentPublisher Type="Vendor">
|
|
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
|
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
|
</DocumentPublisher>
|
|
<DocumentTracking>
|
|
<Identification>
|
|
<ID>openEuler-SA-2021-1002</ID>
|
|
</Identification>
|
|
<Status>Final</Status>
|
|
<Version>1.0</Version>
|
|
<RevisionHistory>
|
|
<Revision>
|
|
<Number>1.0</Number>
|
|
<Date>2021-01-28</Date>
|
|
<Description>Initial</Description>
|
|
</Revision>
|
|
</RevisionHistory>
|
|
<InitialReleaseDate>2021-01-28</InitialReleaseDate>
|
|
<CurrentReleaseDate>2021-01-28</CurrentReleaseDate>
|
|
<Generator>
|
|
<Engine>openEuler SA Tool V1.0</Engine>
|
|
<Date>2021-01-28</Date>
|
|
</Generator>
|
|
</DocumentTracking>
|
|
<DocumentNotes>
|
|
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">sudo security update</Note>
|
|
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for sudo is now available for openEuler-20.03-LTS and openEuler-20.03-LTS-SP1.</Note>
|
|
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">A flaw was found in sudo. A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is exploitable by any local user (normal users and system users, sudoers and non-sudoers), without authentication (i.e., the attacker does not need to know the user's password). Successful exploitation of this flaw could lead to privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-3156)\r\n\r\n
|
|
The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.(CVE-2021-23239)\r\n\r\n
|
|
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.(CVE-2021-23240)\r\n\r\n
|
|
</Note>
|
|
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for sudo is now available for openEuler-20.03-LTS and openEuler-20.03-LTS-SP1.\r\n\r\n
|
|
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
|
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">High</Note>
|
|
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">sudo</Note>
|
|
</DocumentNotes>
|
|
<DocumentReferences>
|
|
<Reference Type="Self">
|
|
<URL>https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1002</URL>
|
|
</Reference>
|
|
<Reference Type="openEuler CVE">
|
|
<URL>https://openeuler.org/en/security/cve/detail.html?id=CVE-2021-3156</URL>
|
|
<URL>https://openeuler.org/en/security/cve/detail.html?id=CVE-2021-23239</URL>
|
|
<URL>https://openeuler.org/en/security/cve/detail.html?id=CVE-2021-23240</URL>
|
|
</Reference>
|
|
<Reference Type="Other">
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2021-3156</URL>
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2021-23239</URL>
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2021-23240</URL>
|
|
</Reference>
|
|
</DocumentReferences>
|
|
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
|
<Branch Type="Product Name" Name="openEuler">
|
|
<FullProductName ProductID="openEuler-20.03-LTS" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">openEuler-20.03-LTS</FullProductName>
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="aarch64">
|
|
<FullProductName ProductID="sudo-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-1.9.2-2.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-debuginfo-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-debuginfo-1.9.2-2.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-debugsource-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-debugsource-1.9.2-2.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-devel-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-devel-1.9.2-2.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-help-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-help-1.9.2-2.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-1.9.2-3.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-debuginfo-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-debuginfo-1.9.2-3.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-debugsource-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-debugsource-1.9.2-3.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-devel-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-devel-1.9.2-3.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-help-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-help-1.9.2-3.oe1.noarch.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="src">
|
|
<FullProductName ProductID="sudo-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-1.9.2-2.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-1.9.2-3.oe1.src.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="x86_64">
|
|
<FullProductName ProductID="sudo-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-1.9.2-2.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-debuginfo-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-debuginfo-1.9.2-2.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-debugsource-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-debugsource-1.9.2-2.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-devel-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-devel-1.9.2-2.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-help-1.9.2-2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">sudo-help-1.9.2-2.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-1.9.2-3.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-debuginfo-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-debuginfo-1.9.2-3.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-debugsource-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-debugsource-1.9.2-3.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-devel-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-devel-1.9.2-3.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="sudo-help-1.9.2-3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">sudo-help-1.9.2-3.oe1.noarch.rpm</FullProductName>
|
|
</Branch>
|
|
</ProductTree>
|
|
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A flaw was found in sudo. A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is exploitable by any local user (normal users and system users, sudoers and non-sudoers), without authentication (i.e., the attacker does not need to know the user's password). Successful exploitation of this flaw could lead to privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2021-01-28</ReleaseDate>
|
|
<CVE>CVE-2021-3156</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>High</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>7.8</BaseScore>
|
|
<Vector>AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>sudo security update</Description>
|
|
<DATE>2021-01-28</DATE>
|
|
<URL>https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1002</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
<Vulnerability Ordinal="2" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="2" xml:lang="en">The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2021-01-28</ReleaseDate>
|
|
<CVE>CVE-2021-23239</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>Low</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>2.5</BaseScore>
|
|
<Vector>AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>sudo security update</Description>
|
|
<DATE>2021-01-28</DATE>
|
|
<URL>https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1002</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
<Vulnerability Ordinal="3" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="3" xml:lang="en">selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2021-01-28</ReleaseDate>
|
|
<CVE>CVE-2021-23240</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>High</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>7.8</BaseScore>
|
|
<Vector>AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>sudo security update</Description>
|
|
<DATE>2021-01-28</DATE>
|
|
<URL>https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1002</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
</cvrfdoc> |