SB2023012346 - Red Hat Enterprise Linux 7 update for sudo 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023012346

SB2023012346 - Red Hat Enterprise Linux 7 update for sudo

Published: January 23, 2023 Updated: October 25, 2024

Security Bulletin ID SB2023012346
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Input validation error (CVE-ID: CVE-2023-22809)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists within the sudoedit (aka -e) feature due to insufficient validation of user-supplied input passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR). The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. A local user can append arbitrary entries to the list of files to process and escalate privileges on the system.


Remediation

Install update from vendor's website.

References