diff options
| author | Changqing Li <changqing.li@windriver.com> | 2019-10-29 10:47:30 +0100 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2019-10-30 13:47:54 +0000 |
| commit | eb54600df16932fcee7880eff67b9bba59e15ba1 (patch) | |
| tree | 298e3d94b31829ac36496097b45901b2275da723 /documentation/ref-manual | |
| parent | c8125e68c6160c5fad45fb64ac43f66924970ce9 (diff) | |
| download | poky-eb54600df16932fcee7880eff67b9bba59e15ba1.tar.gz | |
sudo: fix CVE-2019-14287
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer
account can bypass certain policy blacklists and session PAM modules,
and can cause incorrect logging, by invoking sudo with a crafted user
ID. For example, this allows bypass of !root configuration, and USER=
logging, for a "sudo -u \#$((0xffffffff))" command.
(From OE-Core rev: 650dd9486d6e5410665d5376be30732c7625396d)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4e11cd561f2bdaa6807cf02ee7c9870881826308)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit b1e0149c41e3c344a0496e64ab3b0c9dd4685ea4)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'documentation/ref-manual')
0 files changed, 0 insertions, 0 deletions