sudo vulnerability

[vmelamed]

I just did sudo apt update && sudo apt upgrade and I see that there is an update for the sudo package. Does this address the latest sudo vulnerability?

[crramirez]

Hello,

Yes.

apt-get changelog sudo

sudo (1.9.5p1-1.1) unstable; urgency=high

  * Non-maintainer upload.
  * Heap-based buffer overflow (CVE-2021-3156)
    - Reset valid_flags to MODE_NONINTERACTIVE for sudoedit
    - Add sudoedit flag checks in plugin that are consistent with front-end
    - Fix potential buffer overflow when unescaping backslashes in user_args
    - Fix the memset offset when converting a v1 timestamp to TS_LOCKEXCL
    - Don't assume that argv is allocated as a single flat buffer

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 20 Jan 2021 10:11:47 +0100

[symbiont-val-melamed]

Great!