CVE-2023-28487

概要

参考情報

• sudo-project/sudo commit 334daf9 · Patch
• sudo-project/sudo release SUDO_1_9_13 · Release Notes
• lists.debian.org/debian-lts-announce/2024/02/msg00002.html
• security.gentoo.org/glsa/202309-12 · Third Party Advisory
• security.netapp.com/advisory/ntap-20230420-0002 · Third Party Advisory

sudo のその他の脆弱性

• CVE-2026-35535高 7.8In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer…
• CVE-2025-32463高 7.8悪用確認済み（CISA KEV）Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the -…
• CVE-2025-32462高 8.8Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to e…
• CVE-2023-7090高 8.8A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore,…
• CVE-2023-42465高 7.0Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is…