BSD Portssecurity/sudo-rs -- sudoedit could circumvent /etc/sudoers restrictions
Trifecta Tech Foundation reports: Users that are explicitly permitted to edit only specific files using sudoedit, are still able to place files in arbitrary directories. This only affects systems where sudoedit is used to give very fine-grained edit permissions, which is not the default configuration. For users that have full sudoedit permission or no sudoedit permission at all, no escalation is enabled by this bug. …
Affected versions
- sudo-rs, sudo-rs-coexist >= 0.2.8 < 0.2.15
By system
0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | security/sudo-rs | 0.2.15_2 | fixed |