Homepage
About Snyk

Improper Access Control Affecting sudo package, versions <0:1.8.29-5.el8

Severity

 Recommended
medium

Based on CentOS security rating

    Threat Intelligence

    EPSS
    0.76% (82nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-CENTOS8-SUDO-2039548
  • published 26 Jul 2021
  • disclosed 19 Dec 2019
Report a new vulnerability Found a mistake?

Introduced: 19 Dec 2019

CVE-2019-19234 Open this link in a new tab
CWE-284 Open this link in a new tab

How to fix?

Upgrade Centos:8 sudo to version 0:1.8.29-5.el8 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream sudo package and not the sudo package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are only accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the shell of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash

References

CVSS Scores

version 3.1
Expand this section

NVD

7.5 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    High
  • Availability (A)
    None
Expand this section

Red Hat

7.5 high