CVE-2021-23240 log
| Source |
|
| Severity | High |
| Remote | No |
| Type | Arbitrary filesystem access |
| Description | A security issue was found in sudo before version 1.9.5. On a system with SELinux in permissive mode, an attacker could use sudoedit to change the ownership of arbitrary files by replacing a temporary file owned by an unprivileged user with a symlink to another file. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-1432 | sudo | 1.9.4.p2-2 | 1.9.5.p1-1 | High | Not affected |
| References |
|---|
https://www.openwall.com/lists/oss-security/2021/01/11/2 https://www.sudo.ws/alerts/sudoedit_selinux.html https://www.sudo.ws/repos/sudo/rev/8fcb36ef422a |
| Notes |
|---|
Workaround ========== The issue is mitigated by the SELinux enforce mode or the kernel symbolic link protection (sysctl fs.protected_symlinks=1). |