CVE-2022-43995
Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2022-43995 sudo Corrigé dans: 1.9.12-r1
- Debian DEBIAN-CVE-2022-43995 sudo
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory sudo.ws
- patch github.com
- report bugzilla.redhat.com
- web news.ycombinator.com