Security update for sudo SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:4077-1 Final 1 1 2022-11-18T14:05:40Z current 2022-11-18T14:05:40Z 2022-11-18T14:05:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sudo This update for sudo fixes the following issues: - CVE-2022-43995: Fixed a potential heap-based buffer over-read when entering a passwor dof seven characters or fewer and using the crypt() password backend (bsc#1204986). - Fix wrong information output in the error message (bsc#1190818). - Make sure SIGCHLD is not ignored when sudo is executed; fixes race condition (bsc#1203201). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container ses/7.1/cephcsi/cephcsi:latest-2022-4077,Container ses/7.1/rook/ceph:latest-2022-4077,Container suse/sle-micro-rancher/5.2:latest-2022-4077,Container suse/sle-micro/5.1/toolbox:latest-2022-4077,Container suse/sle-micro/5.2/toolbox:latest-2022-4077,Image SLES15-SP3-CHOST-BYOS-Aliyun-2022-4077,Image SLES15-SP3-CHOST-BYOS-Azure-2022-4077,Image SLES15-SP3-CHOST-BYOS-EC2-2022-4077,Image SLES15-SP3-CHOST-BYOS-GCE-2022-4077,Image SLES15-SP3-CHOST-BYOS-SAP-CCloud-2022-4077,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure-2022-4077,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM-2022-4077,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE-2022-4077,Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2022-4077,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2022-4077,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2022-4077,Image SLES15-SP3-Micro-5-1-BYOS-Azure-2022-4077,Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM-2022-4077,Image SLES15-SP3-Micro-5-1-BYOS-GCE-2022-4077,Image SLES15-SP3-Micro-5-2-BYOS-Azure-2022-4077,Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM-2022-4077,Image SLES15-SP3-Micro-5-2-BYOS-GCE-2022-4077,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2022-4077,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2022-4077,SUSE-2022-4077,SUSE-SLE-Module-Basesystem-15-SP3-2022-4077,SUSE-SUSE-MicroOS-5.1-2022-4077,SUSE-SUSE-MicroOS-5.2-2022-4077,openSUSE-Leap-Micro-5.2-2022-4077,openSUSE-SLE-15.3-2022-4077 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20224077-1/ Link for SUSE-SU-2022:4077-1 https://lists.suse.com/pipermail/sle-updates/2022-November/026309.html E-Mail link for SUSE-SU-2022:4077-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1190818 SUSE Bug 1190818 https://bugzilla.suse.com/1203201 SUSE Bug 1203201 https://bugzilla.suse.com/1204986 SUSE Bug 1204986 https://www.suse.com/security/cve/CVE-2022-43995/ SUSE CVE CVE-2022-43995 page Container ses/7.1/cephcsi/cephcsi:latest Container ses/7.1/rook/ceph:latest Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.1/toolbox:latest Container suse/sle-micro/5.2/toolbox:latest Image SLES15-SP3-CHOST-BYOS-Aliyun Image SLES15-SP3-CHOST-BYOS-Azure Image SLES15-SP3-CHOST-BYOS-EC2 Image SLES15-SP3-CHOST-BYOS-GCE Image SLES15-SP3-CHOST-BYOS-SAP-CCloud Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP3-Micro-5-1-BYOS-Azure Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-1-BYOS-GCE Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-2-BYOS-GCE Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15 SP3 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 sudo-1.9.5p2-150300.3.13.1 sudo-devel-1.9.5p2-150300.3.13.1 sudo-plugin-python-1.9.5p2-150300.3.13.1 sudo-test-1.9.5p2-150300.3.13.1 sudo-1.9.5p2-150300.3.13.1 as a component of Container ses/7.1/cephcsi/cephcsi:latest sudo-1.9.5p2-150300.3.13.1 as a component of Container ses/7.1/rook/ceph:latest sudo-1.9.5p2-150300.3.13.1 as a component of Container suse/sle-micro-rancher/5.2:latest sudo-1.9.5p2-150300.3.13.1 as a component of Container suse/sle-micro/5.1/toolbox:latest sudo-1.9.5p2-150300.3.13.1 as a component of Container suse/sle-micro/5.2/toolbox:latest sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-CHOST-BYOS-Aliyun sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-CHOST-BYOS-Azure sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-CHOST-BYOS-EC2 sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-CHOST-BYOS-GCE sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-CHOST-BYOS-SAP-CCloud sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-Azure sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-GCE sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-Azure sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-GCE sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production sudo-1.9.5p2-150300.3.13.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production sudo-1.9.5p2-150300.3.13.1 as a component of SUSE Linux Enterprise Micro 5.1 sudo-1.9.5p2-150300.3.13.1 as a component of SUSE Linux Enterprise Micro 5.2 sudo-1.9.5p2-150300.3.13.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 sudo-devel-1.9.5p2-150300.3.13.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 sudo-plugin-python-1.9.5p2-150300.3.13.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 sudo-1.9.5p2-150300.3.13.1 as a component of openSUSE Leap 15.3 sudo-devel-1.9.5p2-150300.3.13.1 as a component of openSUSE Leap 15.3 sudo-plugin-python-1.9.5p2-150300.3.13.1 as a component of openSUSE Leap 15.3 sudo-test-1.9.5p2-150300.3.13.1 as a component of openSUSE Leap 15.3 sudo-1.9.5p2-150300.3.13.1 as a component of openSUSE Leap Micro 5.2 Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture. CVE-2022-43995 Container ses/7.1/cephcsi/cephcsi:latest:sudo-1.9.5p2-150300.3.13.1 Container ses/7.1/rook/ceph:latest:sudo-1.9.5p2-150300.3.13.1 Container suse/sle-micro-rancher/5.2:latest:sudo-1.9.5p2-150300.3.13.1 Container suse/sle-micro/5.1/toolbox:latest:sudo-1.9.5p2-150300.3.13.1 Container suse/sle-micro/5.2/toolbox:latest:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-CHOST-BYOS-Aliyun:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-CHOST-BYOS-Azure:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-CHOST-BYOS-EC2:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-CHOST-BYOS-GCE:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-CHOST-BYOS-SAP-CCloud:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Micro-5-1-BYOS-Azure:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Micro-5-1-BYOS-GCE:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Micro-5-2-BYOS-Azure:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-Micro-5-2-BYOS-GCE:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:sudo-1.9.5p2-150300.3.13.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:sudo-1.9.5p2-150300.3.13.1 SUSE Linux Enterprise Micro 5.1:sudo-1.9.5p2-150300.3.13.1 SUSE Linux Enterprise Micro 5.2:sudo-1.9.5p2-150300.3.13.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:sudo-1.9.5p2-150300.3.13.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:sudo-devel-1.9.5p2-150300.3.13.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:sudo-plugin-python-1.9.5p2-150300.3.13.1 openSUSE Leap 15.3:sudo-1.9.5p2-150300.3.13.1 openSUSE Leap 15.3:sudo-devel-1.9.5p2-150300.3.13.1 openSUSE Leap 15.3:sudo-plugin-python-1.9.5p2-150300.3.13.1 openSUSE Leap 15.3:sudo-test-1.9.5p2-150300.3.13.1 openSUSE Leap Micro 5.2:sudo-1.9.5p2-150300.3.13.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224077-1/ https://www.suse.com/security/cve/CVE-2022-43995.html CVE-2022-43995 https://bugzilla.suse.com/1204986 SUSE Bug 1204986 https://bugzilla.suse.com/1205838 SUSE Bug 1205838 https://bugzilla.suse.com/1205969 SUSE Bug 1205969 https://bugzilla.suse.com/1206905 SUSE Bug 1206905