SUSE-SU-2019:2667-1

Details

Description of the patch:

This update for sudo fixes the following issues:

CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).

Affected Packages

sudo

SUSE Enterprise Storage 4SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP2SUSE OpenStack Cloud 7

Fixed in:

1.8.10p3-10.23.1

References

ADVISORY

https://bugzilla.suse.com/1153674

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2019-October/006019.html

ADVISORY

https://www.suse.com/security/cve/CVE-2019-14287/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2019/suse-su-20192667-1/