summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/go
diff options
context:
space:
mode:
authorChangqing Li <changqing.li@windriver.com>2019-10-22 10:47:11 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2019-10-29 09:08:18 +0000
commit645d114f7213a6dfac5bcf30d98c9e80a47199c0 (patch)
treea9a375fff385b83a4f3fffa102cf37dae748e069 /meta/recipes-devtools/go
parentdb4b5fd6865defe648a8f190f6e03049d35e1b5a (diff)
downloadpoky-645d114f7213a6dfac5bcf30d98c9e80a47199c0.tar.gz
sudo: fix CVE-2019-14287
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command. (From OE-Core rev: b7b6d39565f8fad61f2347a3fe31c9ee77a4da15) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4e11cd561f2bdaa6807cf02ee7c9870881826308) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/go')
0 files changed, 0 insertions, 0 deletions