ALAS2023-2023-106

Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture. (CVE-2022-43995)

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. (CVE-2023-22809)

aarch64:
    sudo-logsrvd-debuginfo-1.9.12-1.p2.amzn2023.0.2.aarch64
    sudo-devel-1.9.12-1.p2.amzn2023.0.2.aarch64
    sudo-python-plugin-debuginfo-1.9.12-1.p2.amzn2023.0.2.aarch64
    sudo-debuginfo-1.9.12-1.p2.amzn2023.0.2.aarch64
    sudo-python-plugin-1.9.12-1.p2.amzn2023.0.2.aarch64
    sudo-logsrvd-1.9.12-1.p2.amzn2023.0.2.aarch64
    sudo-1.9.12-1.p2.amzn2023.0.2.aarch64
    sudo-debugsource-1.9.12-1.p2.amzn2023.0.2.aarch64

src:
    sudo-1.9.12-1.p2.amzn2023.0.2.src

x86_64:
    sudo-python-plugin-debuginfo-1.9.12-1.p2.amzn2023.0.2.x86_64
    sudo-logsrvd-debuginfo-1.9.12-1.p2.amzn2023.0.2.x86_64
    sudo-debuginfo-1.9.12-1.p2.amzn2023.0.2.x86_64
    sudo-python-plugin-1.9.12-1.p2.amzn2023.0.2.x86_64
    sudo-devel-1.9.12-1.p2.amzn2023.0.2.x86_64
    sudo-logsrvd-1.9.12-1.p2.amzn2023.0.2.x86_64
    sudo-debugsource-1.9.12-1.p2.amzn2023.0.2.x86_64
    sudo-1.9.12-1.p2.amzn2023.0.2.x86_64