Security update for sudo SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0115-1 Final 1 1 2023-01-20T09:23:59Z current 2023-01-20T09:23:59Z 2023-01-20T09:23:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sudo This update for sudo fixes the following issues: - CVE-2023-22809: Fixed an arbitrary file write issue that could be exploited by users with sudoedit permissions (bsc#1207082). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container ses/7.1/cephcsi/cephcsi:latest-2023-115,Container ses/7.1/rook/ceph:latest-2023-115,Container suse/sle-micro-rancher/5.2:latest-2023-115,Container suse/sle-micro/5.1/toolbox:latest-2023-115,Container suse/sle-micro/5.2/toolbox:latest-2023-115,Image SLES15-SP3-CHOST-BYOS-Aliyun-2023-115,Image SLES15-SP3-CHOST-BYOS-Azure-2023-115,Image SLES15-SP3-CHOST-BYOS-EC2-2023-115,Image SLES15-SP3-CHOST-BYOS-GCE-2023-115,Image SLES15-SP3-CHOST-BYOS-SAP-CCloud-2023-115,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure-2023-115,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM-2023-115,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE-2023-115,Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2023-115,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2023-115,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2023-115,Image SLES15-SP3-Micro-5-1-BYOS-Azure-2023-115,Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM-2023-115,Image SLES15-SP3-Micro-5-1-BYOS-GCE-2023-115,Image SLES15-SP3-Micro-5-2-BYOS-Azure-2023-115,Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM-2023-115,Image SLES15-SP3-Micro-5-2-BYOS-GCE-2023-115,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2023-115,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2023-115,SUSE-2023-115,SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-115,SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-115,SUSE-SLE-Product-RT-15-SP3-2023-115,SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-115,SUSE-SLE-Product-SLES_SAP-15-SP3-2023-115,SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-115,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2023-115,SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-115,SUSE-SUSE-MicroOS-5.1-2023-115,SUSE-SUSE-MicroOS-5.2-2023-115,SUSE-Storage-7.1-2023-115,openSUSE-Leap-Micro-5.2-2023-115 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230115-1/ Link for SUSE-SU-2023:0115-1 https://lists.suse.com/pipermail/sle-security-updates/2023-January/013483.html E-Mail link for SUSE-SU-2023:0115-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1207082 SUSE Bug 1207082 https://www.suse.com/security/cve/CVE-2023-22809/ SUSE CVE CVE-2023-22809 page Container ses/7.1/cephcsi/cephcsi:latest Container ses/7.1/rook/ceph:latest Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.1/toolbox:latest Container suse/sle-micro/5.2/toolbox:latest Image SLES15-SP3-CHOST-BYOS-Aliyun Image SLES15-SP3-CHOST-BYOS-Azure Image SLES15-SP3-CHOST-BYOS-EC2 Image SLES15-SP3-CHOST-BYOS-GCE Image SLES15-SP3-CHOST-BYOS-SAP-CCloud Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP3-Micro-5-1-BYOS-Azure Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-1-BYOS-GCE Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-2-BYOS-GCE Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap Micro 5.2 sudo-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-test-1.9.5p2-150300.3.19.1 sudo-1.9.5p2-150300.3.19.1 as a component of Container ses/7.1/cephcsi/cephcsi:latest sudo-1.9.5p2-150300.3.19.1 as a component of Container ses/7.1/rook/ceph:latest sudo-1.9.5p2-150300.3.19.1 as a component of Container suse/sle-micro-rancher/5.2:latest sudo-1.9.5p2-150300.3.19.1 as a component of Container suse/sle-micro/5.1/toolbox:latest sudo-1.9.5p2-150300.3.19.1 as a component of Container suse/sle-micro/5.2/toolbox:latest sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-CHOST-BYOS-Aliyun sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-CHOST-BYOS-Azure sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-CHOST-BYOS-EC2 sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-CHOST-BYOS-GCE sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-CHOST-BYOS-SAP-CCloud sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-Azure sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-GCE sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-Azure sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-GCE sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production sudo-1.9.5p2-150300.3.19.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Enterprise Storage 7.1 sudo-devel-1.9.5p2-150300.3.19.1 as a component of SUSE Enterprise Storage 7.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 as a component of SUSE Enterprise Storage 7.1 sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS sudo-devel-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS sudo-plugin-python-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS sudo-devel-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS sudo-plugin-python-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Micro 5.1 sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Micro 5.2 sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Real Time 15 SP3 sudo-devel-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Real Time 15 SP3 sudo-plugin-python-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Real Time 15 SP3 sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS sudo-devel-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS sudo-plugin-python-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 sudo-devel-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 sudo-plugin-python-1.9.5p2-150300.3.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Manager Proxy 4.2 sudo-devel-1.9.5p2-150300.3.19.1 as a component of SUSE Manager Proxy 4.2 sudo-plugin-python-1.9.5p2-150300.3.19.1 as a component of SUSE Manager Proxy 4.2 sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Manager Retail Branch Server 4.2 sudo-devel-1.9.5p2-150300.3.19.1 as a component of SUSE Manager Retail Branch Server 4.2 sudo-plugin-python-1.9.5p2-150300.3.19.1 as a component of SUSE Manager Retail Branch Server 4.2 sudo-1.9.5p2-150300.3.19.1 as a component of SUSE Manager Server 4.2 sudo-devel-1.9.5p2-150300.3.19.1 as a component of SUSE Manager Server 4.2 sudo-plugin-python-1.9.5p2-150300.3.19.1 as a component of SUSE Manager Server 4.2 sudo-1.9.5p2-150300.3.19.1 as a component of openSUSE Leap Micro 5.2 In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. CVE-2023-22809 Container ses/7.1/cephcsi/cephcsi:latest:sudo-1.9.5p2-150300.3.19.1 Container ses/7.1/rook/ceph:latest:sudo-1.9.5p2-150300.3.19.1 Container suse/sle-micro-rancher/5.2:latest:sudo-1.9.5p2-150300.3.19.1 Container suse/sle-micro/5.1/toolbox:latest:sudo-1.9.5p2-150300.3.19.1 Container suse/sle-micro/5.2/toolbox:latest:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-CHOST-BYOS-Aliyun:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-CHOST-BYOS-Azure:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-CHOST-BYOS-EC2:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-CHOST-BYOS-GCE:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-CHOST-BYOS-SAP-CCloud:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Micro-5-1-BYOS-Azure:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Micro-5-1-BYOS-GCE:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Micro-5-2-BYOS-Azure:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-Micro-5-2-BYOS-GCE:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:sudo-1.9.5p2-150300.3.19.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:sudo-1.9.5p2-150300.3.19.1 SUSE Enterprise Storage 7.1:sudo-1.9.5p2-150300.3.19.1 SUSE Enterprise Storage 7.1:sudo-devel-1.9.5p2-150300.3.19.1 SUSE Enterprise Storage 7.1:sudo-plugin-python-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:sudo-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:sudo-devel-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:sudo-plugin-python-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:sudo-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:sudo-devel-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:sudo-plugin-python-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Micro 5.1:sudo-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Micro 5.2:sudo-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Real Time 15 SP3:sudo-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Real Time 15 SP3:sudo-devel-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Real Time 15 SP3:sudo-plugin-python-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Server 15 SP3-LTSS:sudo-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Server 15 SP3-LTSS:sudo-devel-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Server 15 SP3-LTSS:sudo-plugin-python-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:sudo-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:sudo-devel-1.9.5p2-150300.3.19.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:sudo-plugin-python-1.9.5p2-150300.3.19.1 SUSE Manager Proxy 4.2:sudo-1.9.5p2-150300.3.19.1 SUSE Manager Proxy 4.2:sudo-devel-1.9.5p2-150300.3.19.1 SUSE Manager Proxy 4.2:sudo-plugin-python-1.9.5p2-150300.3.19.1 SUSE Manager Retail Branch Server 4.2:sudo-1.9.5p2-150300.3.19.1 SUSE Manager Retail Branch Server 4.2:sudo-devel-1.9.5p2-150300.3.19.1 SUSE Manager Retail Branch Server 4.2:sudo-plugin-python-1.9.5p2-150300.3.19.1 SUSE Manager Server 4.2:sudo-1.9.5p2-150300.3.19.1 SUSE Manager Server 4.2:sudo-devel-1.9.5p2-150300.3.19.1 SUSE Manager Server 4.2:sudo-plugin-python-1.9.5p2-150300.3.19.1 openSUSE Leap Micro 5.2:sudo-1.9.5p2-150300.3.19.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230115-1/ https://www.suse.com/security/cve/CVE-2023-22809.html CVE-2023-22809 https://bugzilla.suse.com/1207082 SUSE Bug 1207082 https://bugzilla.suse.com/1208053 SUSE Bug 1208053 https://bugzilla.suse.com/1209326 SUSE Bug 1209326 https://bugzilla.suse.com/1214446 SUSE Bug 1214446