Public bug reported:
A new release of sudo is available for merging from Debian.
Ubuntu: 1.9.17p2-7ubuntu5
Debian Unstable: 1.9.17p2-9
### New Debian Changes ###
sudo (1.9.17p2-9) unstable; urgency=medium
* Apply upstream patches to address CVE-2026-96512.
Thanks to Salvatore Bonaccorso (Closes: #1148890)
* snapshot release
-- Marc Haber <[email protected]> Mon, 28 Sep 2026
14:40:42 +0200
sudo (1.9.17p2-8) unstable; urgency=medium
* Mention in NEWS that secure_path was shortened (Closes: #1141402)
* replace b-d libsasl2-dev with libssl-dev
* Update copyright years for recent contributors
* Apply consistent formatting to packaging files.
* Bump Debian Policy version to 4.7.4.
* Fix issues found by Shellcheck.
* Fix spelling.
[ Danilo Egea Gondolfo ]
* debian/tests/04-getroot-sssd:
+ Check if the slapd daemon is ready before proceeding.
In some situations, the next command (ldapmodify) runs before
the service is ready. See LP:#2026888
(cherry picked from commit 91d20afb79e34b10b46c3cc0b219e7e766677fd3)
Signed-off-by: Mitchell Augustin <[email protected]>
-- Marc Haber <[email protected]> Tue, 08 Sep 2026
16:22:41 +0200
### Old Ubuntu Delta ###
sudo (1.9.17p2-7ubuntu5) stonking; urgency=medium
* SECURITY UPDATE: NOTBEFORE or NOTAFTER restrictions bypass via TZ
- debian/patches/CVE-2026-96512-pre1.patch: sudo: ignore user-specified TZ
environment variable in src/sudo.c.
- debian/patches/CVE-2026-96512.patch: Remove TZ from sudo's working
environment without modifying envp. in src/sudo.c.
- CVE-2026-96512
-- Marc Deslauriers <[email protected]> Tue, 06 Oct 2026
09:11:55 -0400
sudo (1.9.17p2-7ubuntu4) stonking; urgency=medium
* SECURITY UPDATE: Policy and Logging Bypass
- debian/patches/CVE-2026-82474-pre1.patch: resolve /proc/self/fd/N
pathname in get_execve_info().
- debian/patches/CVE-2026-82474-pre2.patch: pass correct name to
proc_read_link().
- debian/patches/CVE-2026-82474.patch: add intercept and log_subcmds
support for execveat(2).
- debian/patches/CVE-2026-82474-2.patch: error out if we run out of
space rewriting pathname.
- debian/patches/CVE-2026-82474-3.patch: fix handling of relative paths
in the execveat(2) intercept support.
- CVE-2026-82474
-- John Breton <[email protected]> Mon, 21 Sep 2026 14:37:18
-0400
sudo (1.9.17p2-7ubuntu3) stonking; urgency=medium
* d/t/04-getroot-sssd: adjust slapd apparmor for autopkgtests
(LP: #2156801)
* d/p/openssl4-ftbfs-fix.patch: fix build with OpenSSL4 (LP: #2161810)
* d/t/03-1126085-sudoersd: make sure we are using sudo.ws for this
test, since this is the package shipping the sudo.ws implementation
-- Andreas Hasenack <[email protected]> Tue, 18 Aug 2026
15:35:45 -0300
sudo (1.9.17p2-7ubuntu2) stonking; urgency=medium
* No-change rebuild against libssl4
-- Ravi Kant Sharma <[email protected]> Fri, 24 Jul 2026
11:21:47 +0000
sudo (1.9.17p2-7ubuntu1) stonking; urgency=medium
* Merge with Debian unstable (LP: #2153358). Remaining changes:
- debian/sudo[-ldap].init: delete init scripts, as they are no longer
necessary.
- debian/etc/sudoers:
+ also grant admin group sudo access
+ include /snap/bin in the secure_path
- debian/tests/04-getroot-sssd:
- Check if the slapd daemon is ready before proceeding.
+ In some situations, the next command (ldapmodify) runs before
the service is ready. See LP#2026888
- set alternatives (LP #2111419)
- remove sudo-ldap package (LP #2115781)
+ Whereas Debian introduced a transitional for this package,
we remove it outright.
-- Mitchell Augustin <[email protected]> Fri, 05 Jun
2026 16:28:18 -0500
** Affects: sudo (Ubuntu)
Importance: Wishlist
Status: New
** Tags: dcr-merge
** Changed in: sudo (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: sudo (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171253
Title:
Merge sudo 1.9.17p2-9 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2171253/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
