CVEvulnerability
CVE-2015-8239
7.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-10-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.0 HIGH — CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-362
Description
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
Affected configurations
• sudo project sudo 1.8.8
• sudo project sudo 1.8.9
• sudo project sudo 1.8.10
• sudo project sudo 1.8.11
• sudo project sudo 1.8.12
• sudo project sudo 1.8.13
• sudo project sudo 1.8.14
• sudo project sudo 1.8.15
Related
Weakness · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
References
- http://www.openwall.com/lists/oss-security/2015/11/18/22 Mailing List, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1283635 Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/0cd3cc8fa195 Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/24a3d9215c64 Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/397722cdd7ec Issue Tracking, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/11/18/22 Mailing List, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1283635 Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/0cd3cc8fa195 Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/24a3d9215c64 Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/397722cdd7ec Issue Tracking, Patch, Third Party Advisory