Your message dated Sun, 02 Feb 2020 13:47:24 +0000
with message-id <[email protected]>
and subject line Bug#950371: fixed in sudo 1.8.27-1+deb10u2
has caused the Debian Bug report #950371,
regarding sudo: CVE-2019-18634
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
950371: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950371
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: sudo
Version: 1.8.29-1
Severity: important
Tags: security upstream
Control: found -1 1.8.27-1+deb10u1
Control: found -1 1.8.27-1
Control: found -1 1.8.19p1-2.1+deb9u1
Control: found -1 1.8.19p1-2.1
Hi,
The following vulnerability was published for sudo.
CVE-2019-18634[0]:
| In Sudo before 1.8.31, if pwfeedback is enabled in /etc/sudoers, users
| can trigger a stack-based buffer overflow in the privileged sudo
| process. (pwfeedback is a default setting in Linux Mint and elementary
| OS; however, it is NOT the default for upstream and many other
| packages, and would exist only if enabled by an administrator.) The
| attacker needs to deliver a long string to the stdin of getln() in
| tgetpass.c.
Note that a change in 1.8.26 itself[4] made the bug unexploitable
starting from that version, but the issue itself is fixed upstream in
1.8.31. Could you please close this bug once sudo is rebased in
unstable to 1.8.31 or the bugfix still cherry-picked?
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2019-18634
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18634
[1] https://www.sudo.ws/alerts/pwfeedback.html
[2] https://www.openwall.com/lists/oss-security/2020/01/30/6
[3]
https://github.com/sudo-project/sudo/commit/fa8ffeb17523494f0e8bb49a25e53635f4509078
[4] https://www.openwall.com/lists/oss-security/2020/01/31/1
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: sudo
Source-Version: 1.8.27-1+deb10u2
We believe that the bug you reported is fixed in the latest version of
sudo, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated sudo package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 02 Feb 2020 08:41:42 +0100
Source: sudo
Architecture: source
Version: 1.8.27-1+deb10u2
Distribution: buster
Urgency: medium
Maintainer: Bdale Garbee <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 950371
Changes:
sudo (1.8.27-1+deb10u2) buster; urgency=medium
.
* Non-maintainer upload.
* Fix a buffer overflow when pwfeedback is enabled and input is a not a tty
(CVE-2019-18634) (Closes: #950371)
Checksums-Sha1:
8483f47b18de579a0e8801fe1094f4df9c05cce4 2130 sudo_1.8.27-1+deb10u2.dsc
94cfb9a8dc6925f50183e014ea886a7065e0a9f2 26812
sudo_1.8.27-1+deb10u2.debian.tar.xz
Checksums-Sha256:
28d06f80fbe44afb8d018e80d2b463df95798db1b8579e7238b48197dc7cad6e 2130
sudo_1.8.27-1+deb10u2.dsc
8e6939efd4f8bbeddc00a1cdda06c2dc0634c66967fd521365b9b1988c070643 26812
sudo_1.8.27-1+deb10u2.debian.tar.xz
Files:
eccd0494458b75597e8c8a5c755e5a8d 2130 admin optional sudo_1.8.27-1+deb10u2.dsc
d6b305ae8ff27d515edb568cc59cb9e5 26812 admin optional
sudo_1.8.27-1+deb10u2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl42fzhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EsBMP/jbZsOBliX+kfHKgP5p2u8WjzvNduHjT
BKg7KM0Z5aykB/IJ6iyrPCUodkSv2ETlCfGClWlk0zkm/YC1QvJnFqpioNNRws2/
rERS/arm8kpm4uSZxSLXaS37eGRXErxVF0Nk3P6TJwNIG/1PkeGh9yglk3OhT+1Q
dr+GmtVVNdSnnBRMR1WGk3tFsSIOSlfJdfBieXzWdzSuhs0lKqBz7lWR7YMEIG+V
p4/ErR0kReEzgnM6EJd/YKIVXQDk2KKfD9u8MvfKNHrHFWD0Y1uTFmthhql8UTZF
2qTVIW+2qQkNIk7UYMNZfOF5W3rXw4pk2ID9IZVYuTsb5eCd21BDLcD4DP7BqkDB
AewLzXP61rNRrRcCzYp4vLfOemYvhshBDo4U7l5pwdoH/fDJxcaJA45gfc4zg4M4
dFBVLCExxpLXkyNHq3Tg+G7AawIVPq+9IRabQQNzDaOsTi8THMZ7m0LbmQkH0tCp
Ce9FkpXcwcuYeX11fmoX7h2UUBU8HKnlthnehzjg79FMx/LyvEVs5jmByhvbkbVC
LvW21rrr7MinvoAEnGd9G9n2LBho3bn+bwgq8m2EUJWYQYOC03cDcRBwiNHQpUVx
9rkNM1v92mU83yOrJI3AcinOOzPSMVQTMtb7UT/tvBeATCiCOIeuQZFaQf8NpxLt
H1hcqqkuENt2
=1k/q
-----END PGP SIGNATURE-----
--- End Message ---
