diff options
| author |   Changqing Li <changqing.li@windriver.com> | 2019-10-29 10:47:30 +0100 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2019-10-30 13:47:05 +0000 |
| commit | 650dd9486d6e5410665d5376be30732c7625396d (patch) | |
| tree | 7e96c48cb537daf191570c0803bfd98713576f90 /meta/recipes-devtools/go | |
| parent | a981d9b753a13e100af1f654fb3384f0bcda0b65 (diff) | |
| download | openembedded-core-contrib-650dd9486d6e5410665d5376be30732c7625396d.tar.gz | |
sudo: fix CVE-2019-14287
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer
account can bypass certain policy blacklists and session PAM modules,
and can cause incorrect logging, by invoking sudo with a crafted user
ID. For example, this allows bypass of !root configuration, and USER=
logging, for a "sudo -u \#$((0xffffffff))" command.
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4e11cd561f2bdaa6807cf02ee7c9870881826308)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit b1e0149c41e3c344a0496e64ab3b0c9dd4685ea4)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/go')
0 files changed, 0 insertions, 0 deletions