MGASA-2020-0081

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2020-0081.html
Import Source
https://advisories.mageia.org/MGASA-2020-0081.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2020-0081
Related
Published
2020-02-09T19:13:40Z
Modified
2020-02-09T18:52:27Z
Summary
Updated sudo packages fix security vulnerability
Details

The updated packages fix a security vulnerability:

In Sudo before 1.8.31, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. (CVE-2019-18634)

References
Credits

Affected packages

Mageia:7 / sudo

Package

Name
sudo
Purl
pkg:rpm/mageia/sudo?distro=mageia-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.8.28-1.1.mga7

Ecosystem specific 

{
    "section": "core"
}