Red Hat Security Advisory: sudo security and bug fix update
An update for sudo is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-23240US | high7.8 | — | ||
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symli… | ||||
| CVE-2021-23239US | low2.5 | — | ||
The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacin… | ||||
references
External citations — patches, advisories, analysis.
remediations (52)
- Fixedsudo-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-0:1.8.29-7.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-0:1.8.29-7.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debuginfo-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debuginfo-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debuginfo-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debuginfo-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debuginfo-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debuginfo-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debuginfo-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debuginfo-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debugsource-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debugsource-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debugsource-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debugsource-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debugsource-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debugsource-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debugsource-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Fixedsudo-debugsource-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1723 - Workaroundsudo-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-0:1.8.29-7.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-0:1.8.29-7.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-debuginfo-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-debuginfo-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-debuginfo-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-debuginfo-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-debuginfo-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-debuginfo-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-debuginfo-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-debuginfo-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-debugsource-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-debugsource-0:1.8.29-7.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-debugsource-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-debugsource-0:1.8.29-7.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-debugsource-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-debugsource-0:1.8.29-7.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
- Workaroundsudo-debugsource-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
* Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
- Workaroundsudo-debugsource-0:1.8.29-7.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Enabling the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1) is sufficient to mitigate this flaw.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan