Bug 2255723 (CVE-2023-7090) - CVE-2023-7090 sudo: Improper handling of ipa_hostname leads to privilege mismanagement
Summary: CVE-2023-7090 sudo: Improper handling of ipa_hostname leads to privilege mism...
Keywords:
Status: NEW
Alias: CVE-2023-7090
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2255724
TreeView+ depends on / blocked
 
Reported: 2023-12-23 19:40 UTC by Pedro Sampaio
Modified: 2024-03-20 10:34 UTC (History)
0 users

Fixed In Version: sudo 1.8.28
Doc Type: ---
Doc Text:
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2023-12-23 19:40:31 UTC 
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.

Upstream Patch:

https://github.com/sudo-project/sudo/commit/e99082e05b9f0dd0e0f47fa1d2e1b9d922ea8c4c
https://www.sudo.ws/repos/sudo/rev/b4f31dbe3109
 
Upstream release: 

https://www.sudo.ws/releases/legacy/#1.8.28
 
Red Hat Advisory: 

https://access.redhat.com/errata/RHBA-2019:3598

References:
 
https://sudo.ws/pipermail/sudo-workers/2019-August/001248.html
https://sudo.ws/pipermail/sudo-workers/2019-August/001249.html
Note You need to log in before you can comment on or make changes to this bug.