diff options
author | Changqing Li <changqing.li@windriver.com> | 2019-10-22 10:47:11 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2019-10-23 16:26:15 +0100 |
commit | 4e11cd561f2bdaa6807cf02ee7c9870881826308 (patch) | |
tree | 79f6336c0f8b297cf5e067f06fe25faee05301e1 /meta/recipes-gnome | |
parent | 6665e84bfba43cd8897b9561b14975ac524fbbe2 (diff) | |
download | openembedded-core-contrib-4e11cd561f2bdaa6807cf02ee7c9870881826308.tar.gz |
sudo: fix CVE-2019-14287
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer
account can bypass certain policy blacklists and session PAM modules,
and can cause incorrect logging, by invoking sudo with a crafted user
ID. For example, this allows bypass of !root configuration, and USER=
logging, for a "sudo -u \#$((0xffffffff))" command.
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-gnome')
0 files changed, 0 insertions, 0 deletions