diff options
| author |   Changqing Li <changqing.li@windriver.com> | 2019-10-22 10:47:11 +0800 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2019-10-29 08:20:37 +0000 |
| commit | b7b6d39565f8fad61f2347a3fe31c9ee77a4da15 (patch) | |
| tree | e255a785fd7f95e4cf704a417e7ec8124c23db89 /meta/recipes-sato | |
| parent | a9d3cae5668fbcae7145b8cdba786caa30b5b3d3 (diff) | |
| download | openembedded-core-contrib-b7b6d39565f8fad61f2347a3fe31c9ee77a4da15.tar.gz | |
sudo: fix CVE-2019-14287
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer
account can bypass certain policy blacklists and session PAM modules,
and can cause incorrect logging, by invoking sudo with a crafted user
ID. For example, this allows bypass of !root configuration, and USER=
logging, for a "sudo -u \#$((0xffffffff))" command.
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4e11cd561f2bdaa6807cf02ee7c9870881826308)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'meta/recipes-sato')
0 files changed, 0 insertions, 0 deletions