var-202101-1926
Vulnerability from variot
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. Summary:
Red Hat Ansible Automation Platform Resource Operator 1.2 (technical preview) images that fix several security issues. Description:
Red Hat Ansible Automation Platform Resource Operator container images with security fixes.
Ansible Automation Platform manages Ansible Platform jobs and workflows that can interface with any infrastructure on a Red Hat OpenShift Container Platform cluster, or on a traditional infrastructure that is running off-cluster. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/):
1914774 - CVE-2021-20178 ansible: user data leak in snmp_facts module 1915808 - CVE-2021-20180 ansible module: bitbucket_pipeline_variable exposes secured values 1916813 - CVE-2021-20191 ansible: multiple modules expose secured values 1925002 - CVE-2021-20228 ansible: basic.py no_log with fallback option 1939349 - CVE-2021-3447 ansible: multiple modules expose secured values
- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: sudo security update Advisory ID: RHSA-2021:0221-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:0221 Issue date: 2021-01-26 CVE Names: CVE-2021-3156 ==================================================================== 1. Summary:
An update for sudo is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
- Description:
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
- sudo: Heap buffer overflow in argument parsing (CVE-2021-3156)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
1917684 - CVE-2021-3156 sudo: Heap buffer overflow in argument parsing
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source: sudo-1.8.23-10.el7_9.1.src.rpm
x86_64: sudo-1.8.23-10.el7_9.1.x86_64.rpm sudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: sudo-debuginfo-1.8.23-10.el7_9.1.i686.rpm sudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm sudo-devel-1.8.23-10.el7_9.1.i686.rpm sudo-devel-1.8.23-10.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: sudo-1.8.23-10.el7_9.1.src.rpm
x86_64: sudo-1.8.23-10.el7_9.1.x86_64.rpm sudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64: sudo-debuginfo-1.8.23-10.el7_9.1.i686.rpm sudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm sudo-devel-1.8.23-10.el7_9.1.i686.rpm sudo-devel-1.8.23-10.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: sudo-1.8.23-10.el7_9.1.src.rpm
ppc64: sudo-1.8.23-10.el7_9.1.ppc64.rpm sudo-debuginfo-1.8.23-10.el7_9.1.ppc64.rpm
ppc64le: sudo-1.8.23-10.el7_9.1.ppc64le.rpm sudo-debuginfo-1.8.23-10.el7_9.1.ppc64le.rpm
s390x: sudo-1.8.23-10.el7_9.1.s390x.rpm sudo-debuginfo-1.8.23-10.el7_9.1.s390x.rpm
x86_64: sudo-1.8.23-10.el7_9.1.x86_64.rpm sudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64: sudo-debuginfo-1.8.23-10.el7_9.1.ppc.rpm sudo-debuginfo-1.8.23-10.el7_9.1.ppc64.rpm sudo-devel-1.8.23-10.el7_9.1.ppc.rpm sudo-devel-1.8.23-10.el7_9.1.ppc64.rpm
ppc64le: sudo-debuginfo-1.8.23-10.el7_9.1.ppc64le.rpm sudo-devel-1.8.23-10.el7_9.1.ppc64le.rpm
s390x: sudo-debuginfo-1.8.23-10.el7_9.1.s390.rpm sudo-debuginfo-1.8.23-10.el7_9.1.s390x.rpm sudo-devel-1.8.23-10.el7_9.1.s390.rpm sudo-devel-1.8.23-10.el7_9.1.s390x.rpm
x86_64: sudo-debuginfo-1.8.23-10.el7_9.1.i686.rpm sudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm sudo-devel-1.8.23-10.el7_9.1.i686.rpm sudo-devel-1.8.23-10.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: sudo-1.8.23-10.el7_9.1.src.rpm
x86_64: sudo-1.8.23-10.el7_9.1.x86_64.rpm sudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64: sudo-debuginfo-1.8.23-10.el7_9.1.i686.rpm sudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm sudo-devel-1.8.23-10.el7_9.1.i686.rpm sudo-devel-1.8.23-10.el7_9.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2021-3156 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/RHSB-2021-002
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYBB9QtzjgjWX9erEAQjMkQ/+PUDUX16Tnzqt7l1CsDAkHsT89EyY1keR 5XAlnrEv0nfw+/Feb2zhjlAlGbZSE1pTHOB4WarZzz2edZW5PRDw2SnljPToGoF2 6e4rlxRMJzFzc1WiOl5VgIq2LsOrqE1x3smwx7UGloMNmld/wgNKzFyddlR3ya0/ k78GAgUD2K/riILpeSG9M3jkK6IX/ecAOV8cK4GnmVAyrc/I0ud+wp+AFaQdKOUd DJ08C4ktxCEDZnCMV7X0fheoVB08T2VUPqM3AT0mP8Q07RWElFNAYYzS0/0ABGdd G/bRXDOiP0Qp92gMjWi4zu8JJk1Yyt8vnXII30gr2dd4f/8O0X6N+fntkhpc86N0 mdXrPNBDXC6YJqahqtTH3ZMNWj37kSX5O0QIxRMMySIuPEhLdkF0A4CBGcP1qpaN BQf/nNAvYlkz70QTL91JkUL98X0Ih+O6IAPxT//C90VXwXTb2+XmBBYjA24/gHJn kpv9ZzJfeCSCVoa019u3r/8pkMIfiN69GpO2FQTJCP4MbIJPHeANp2lYEA+KHPqE XJvy0qh3YEs741KxKwzbaMgOTrYsoMvKhVeJZm0t5bpU5Y5TTF9fCVan8uJ8ke6d buQej1iyBUvPq+gMQvJhwiP1Q2rvgxPmHP+L3Awo9tTqm6b7WsqdRq5K+B025v+d NdZXKIPEQVY=7/vM -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . These packages include redhat-release-virtualization-host. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.
Bug Fix(es):
- When performing an upgrade of the Red Hat Virtualization Host using the
command
yum update
, the yum repository for RHV 4.3 EUS is unreachable
As a workaround, run the following command:
# yum update --releasever=7Server
(BZ#1899378)
- Bugs fixed (https://bugzilla.redhat.com/):
1889686 - CVE-2020-25684 dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker 1889688 - CVE-2020-25685 dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker 1890125 - CVE-2020-25686 dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker 1899378 - rhel-7-server-rhvh-4.3-eus-rpms repo is unavailable 1916111 - Rebase RHV-H 4.3 EUS on RHEL 7.9.z #3 1917684 - CVE-2021-3156 sudo: Heap buffer overflow in argument parsing
- ========================================================================== Ubuntu Security Notice USN-4705-2 January 27, 2021
sudo vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in Sudo. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain unintended access to the administrator account. (CVE-2021-3156)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.04 ESM: sudo 1.8.9p5-1ubuntu1.5+esm6
Ubuntu 12.04 ESM: sudo 1.8.3p1-1ubuntu3.10
In general, a standard system update will make all the necessary changes. 8) - aarch64, ppc64le, s390x, x86_64
3
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202101-1926", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "10.0" }, { "model": "tekelec platform distribution", "scope": "lte", "trust": 1.0, "vendor": "oracle", "version": "7.7.1" }, { "model": "active iq unified manager", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": null }, { "model": "ontap tools", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": "9" }, { "model": "oncommand unified manager core package", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": null }, { "model": "micros workstation 6", "scope": "gte", "trust": 1.0, "vendor": "oracle", "version": "610" }, { "model": "micros workstation 6", "scope": "lte", "trust": 1.0, "vendor": "oracle", "version": "655" }, { "model": "communications performance intelligence center", "scope": "lte", "trust": 1.0, "vendor": "oracle", "version": "10.4.0.3.1" }, { "model": "sudo", "scope": "eq", "trust": 1.0, "vendor": "sudo", "version": "1.9.5" }, { "model": "micros compact workstation 3", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "310" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "33" }, { "model": "hci management node", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": null }, { "model": "web gateway", "scope": "eq", "trust": 1.0, "vendor": "mcafee", "version": "8.2.17" }, { "model": "tekelec platform distribution", "scope": "gte", "trust": 1.0, "vendor": "oracle", "version": "7.4.0" }, { "model": "ontap select deploy administration utility", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": null }, { "model": "privilege management for mac", "scope": "lt", "trust": 1.0, "vendor": "beyondtrust", "version": "21.1.1" }, { "model": "communications performance intelligence center", "scope": "gte", "trust": 1.0, "vendor": "oracle", "version": "10.4.0.1.0" }, { "model": "micros workstation 5a", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "5a" }, { "model": "sudo", "scope": "gte", "trust": 1.0, "vendor": "sudo", "version": "1.9.0" }, { "model": "skynas", "scope": "eq", "trust": 1.0, "vendor": "synology", "version": null }, { "model": "privilege management for unix\\/linux", "scope": "lt", "trust": 1.0, "vendor": "beyondtrust", "version": "10.3.2-10" }, { "model": "diskstation manager", "scope": "eq", "trust": 1.0, "vendor": "synology", "version": "6.2" }, { "model": "diskstation manager unified controller", "scope": "eq", "trust": 1.0, "vendor": "synology", "version": "3.0" }, { "model": "communications performance intelligence center", "scope": "lte", "trust": 1.0, "vendor": "oracle", "version": "10.3.0.2.1" }, { "model": "micros es400", "scope": "gte", "trust": 1.0, "vendor": "oracle", "version": "400" }, { "model": "sudo", "scope": "lt", "trust": 1.0, "vendor": "sudo", "version": "1.9.5" }, { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "9.0" }, { "model": "communications performance intelligence center", "scope": "gte", "trust": 1.0, "vendor": "oracle", "version": "10.3.0.0.0" }, { "model": "web gateway", "scope": "eq", "trust": 1.0, "vendor": "mcafee", "version": "9.2.8" }, { "model": "cloud backup", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": null }, { "model": "vs960hd", "scope": "eq", "trust": 1.0, "vendor": "synology", "version": null }, { "model": "micros es400", "scope": "lte", "trust": 1.0, "vendor": "oracle", "version": "410" }, { "model": "micros kitchen display system", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "210" }, { "model": "solidfire", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": null }, { "model": "sudo", "scope": "gte", "trust": 1.0, "vendor": "sudo", "version": "1.8.2" }, { "model": "sudo", "scope": "lt", "trust": 1.0, "vendor": "sudo", "version": "1.8.32" }, { "model": "web gateway", "scope": "eq", "trust": 1.0, "vendor": "mcafee", "version": "10.0.4" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "32" } ], "sources": [ { "db": "NVD", "id": "CVE-2021-3156" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:sudo_project:sudo:1.9.5:patch1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.9.5", "versionStartIncluding": "1.9.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:sudo_project:sudo:1.9.5:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.8.32", "versionStartIncluding": "1.8.2", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:mcafee:web_gateway:8.2.17:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:mcafee:web_gateway:9.2.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:mcafee:web_gateway:10.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:synology:diskstation_manager:6.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:synology:diskstation_manager_unified_controller:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:synology:skynas_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:synology:skynas:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:beyondtrust:privilege_management_for_mac:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "21.1.1", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:beyondtrust:privilege_management_for_unix\\/linux:*:*:*:*:basic:*:*:*", "cpe_name": [], "versionEndExcluding": "10.3.2-10", "vulnerable": true } ], "operator": "OR" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:oracle:micros_compact_workstation_3_firmware:310:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:oracle:micros_compact_workstation_3:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:oracle:micros_es400_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "410", "versionStartIncluding": "400", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:oracle:micros_es400:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:oracle:micros_kitchen_display_system_firmware:210:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:oracle:micros_kitchen_display_system:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:oracle:micros_workstation_5a_firmware:5a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:oracle:micros_workstation_5a:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:oracle:micros_workstation_6_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "655", "versionStartIncluding": "610", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:oracle:micros_workstation_6:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "7.7.1", "versionStartIncluding": "7.4.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "10.4.0.3.1", "versionStartIncluding": "10.4.0.1.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "10.3.0.2.1", "versionStartIncluding": "10.3.0.0.0", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2021-3156" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Red Hat", "sources": [ { "db": "PACKETSTORM", "id": "161139" }, { "db": "PACKETSTORM", "id": "162142" }, { "db": "PACKETSTORM", "id": "161143" }, { "db": "PACKETSTORM", "id": "161272" }, { "db": "PACKETSTORM", "id": "161138" } ], "trust": 0.5 }, "cve": "CVE-2021-3156", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "NVD", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 3.9, "impactScore": 10.0, "integrityImpact": "COMPLETE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 3.9, "id": "VHN-383931", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.8, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } ], "severity": [ { "author": "NVD", "id": "CVE-2021-3156", "trust": 1.0, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-383931", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-383931" }, { "db": "NVD", "id": "CVE-2021-3156" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via \"sudoedit -s\" and a command-line argument that ends with a single backslash character. Summary:\n\nRed Hat Ansible Automation Platform Resource Operator 1.2 (technical\npreview) images that fix several security issues. Description:\n\nRed Hat Ansible Automation Platform Resource Operator container images\nwith security fixes. \n\nAnsible Automation Platform manages Ansible Platform jobs and workflows\nthat can interface with any infrastructure on a Red Hat OpenShift Container\nPlatform cluster, or on a traditional infrastructure that is running\noff-cluster. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/):\n\n1914774 - CVE-2021-20178 ansible: user data leak in snmp_facts module\n1915808 - CVE-2021-20180 ansible module: bitbucket_pipeline_variable exposes secured values\n1916813 - CVE-2021-20191 ansible: multiple modules expose secured values\n1925002 - CVE-2021-20228 ansible: basic.py no_log with fallback option\n1939349 - CVE-2021-3447 ansible: multiple modules expose secured values\n\n5. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Important: sudo security update\nAdvisory ID: RHSA-2021:0221-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2021:0221\nIssue date: 2021-01-26\nCVE Names: CVE-2021-3156\n====================================================================\n1. Summary:\n\nAn update for sudo is now available for Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\n\n3. Description:\n\nThe sudo packages contain the sudo utility which allows system\nadministrators to provide certain users with the permission to execute\nprivileged commands, which are used for system management purposes, without\nhaving to log in as root. \n\nSecurity Fix(es):\n\n* sudo: Heap buffer overflow in argument parsing (CVE-2021-3156)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1917684 - CVE-2021-3156 sudo: Heap buffer overflow in argument parsing\n\n6. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nsudo-1.8.23-10.el7_9.1.src.rpm\n\nx86_64:\nsudo-1.8.23-10.el7_9.1.x86_64.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\nsudo-debuginfo-1.8.23-10.el7_9.1.i686.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm\nsudo-devel-1.8.23-10.el7_9.1.i686.rpm\nsudo-devel-1.8.23-10.el7_9.1.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nsudo-1.8.23-10.el7_9.1.src.rpm\n\nx86_64:\nsudo-1.8.23-10.el7_9.1.x86_64.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nx86_64:\nsudo-debuginfo-1.8.23-10.el7_9.1.i686.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm\nsudo-devel-1.8.23-10.el7_9.1.i686.rpm\nsudo-devel-1.8.23-10.el7_9.1.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nsudo-1.8.23-10.el7_9.1.src.rpm\n\nppc64:\nsudo-1.8.23-10.el7_9.1.ppc64.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.ppc64.rpm\n\nppc64le:\nsudo-1.8.23-10.el7_9.1.ppc64le.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.ppc64le.rpm\n\ns390x:\nsudo-1.8.23-10.el7_9.1.s390x.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.s390x.rpm\n\nx86_64:\nsudo-1.8.23-10.el7_9.1.x86_64.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nppc64:\nsudo-debuginfo-1.8.23-10.el7_9.1.ppc.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.ppc64.rpm\nsudo-devel-1.8.23-10.el7_9.1.ppc.rpm\nsudo-devel-1.8.23-10.el7_9.1.ppc64.rpm\n\nppc64le:\nsudo-debuginfo-1.8.23-10.el7_9.1.ppc64le.rpm\nsudo-devel-1.8.23-10.el7_9.1.ppc64le.rpm\n\ns390x:\nsudo-debuginfo-1.8.23-10.el7_9.1.s390.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.s390x.rpm\nsudo-devel-1.8.23-10.el7_9.1.s390.rpm\nsudo-devel-1.8.23-10.el7_9.1.s390x.rpm\n\nx86_64:\nsudo-debuginfo-1.8.23-10.el7_9.1.i686.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm\nsudo-devel-1.8.23-10.el7_9.1.i686.rpm\nsudo-devel-1.8.23-10.el7_9.1.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nsudo-1.8.23-10.el7_9.1.src.rpm\n\nx86_64:\nsudo-1.8.23-10.el7_9.1.x86_64.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\nsudo-debuginfo-1.8.23-10.el7_9.1.i686.rpm\nsudo-debuginfo-1.8.23-10.el7_9.1.x86_64.rpm\nsudo-devel-1.8.23-10.el7_9.1.i686.rpm\nsudo-devel-1.8.23-10.el7_9.1.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2021-3156\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2021-002\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYBB9QtzjgjWX9erEAQjMkQ/+PUDUX16Tnzqt7l1CsDAkHsT89EyY1keR\n5XAlnrEv0nfw+/Feb2zhjlAlGbZSE1pTHOB4WarZzz2edZW5PRDw2SnljPToGoF2\n6e4rlxRMJzFzc1WiOl5VgIq2LsOrqE1x3smwx7UGloMNmld/wgNKzFyddlR3ya0/\nk78GAgUD2K/riILpeSG9M3jkK6IX/ecAOV8cK4GnmVAyrc/I0ud+wp+AFaQdKOUd\nDJ08C4ktxCEDZnCMV7X0fheoVB08T2VUPqM3AT0mP8Q07RWElFNAYYzS0/0ABGdd\nG/bRXDOiP0Qp92gMjWi4zu8JJk1Yyt8vnXII30gr2dd4f/8O0X6N+fntkhpc86N0\nmdXrPNBDXC6YJqahqtTH3ZMNWj37kSX5O0QIxRMMySIuPEhLdkF0A4CBGcP1qpaN\nBQf/nNAvYlkz70QTL91JkUL98X0Ih+O6IAPxT//C90VXwXTb2+XmBBYjA24/gHJn\nkpv9ZzJfeCSCVoa019u3r/8pkMIfiN69GpO2FQTJCP4MbIJPHeANp2lYEA+KHPqE\nXJvy0qh3YEs741KxKwzbaMgOTrYsoMvKhVeJZm0t5bpU5Y5TTF9fCVan8uJ8ke6d\nbuQej1iyBUvPq+gMQvJhwiP1Q2rvgxPmHP+L3Awo9tTqm6b7WsqdRq5K+B025v+d\nNdZXKIPEQVY=7/vM\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. These packages include redhat-release-virtualization-host. \nRHVH features a Cockpit user interface for monitoring the host\u0027s resources\nand performing administrative tasks. \n\nBug Fix(es):\n\n* When performing an upgrade of the Red Hat Virtualization Host using the\ncommand `yum update`, the yum repository for RHV 4.3 EUS is unreachable\n\nAs a workaround, run the following command:\n`# yum update --releasever=7Server` (BZ#1899378)\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1889686 - CVE-2020-25684 dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker\n1889688 - CVE-2020-25685 dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker\n1890125 - CVE-2020-25686 dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker\n1899378 - rhel-7-server-rhvh-4.3-eus-rpms repo is unavailable\n1916111 - Rebase RHV-H 4.3 EUS on RHEL 7.9.z #3\n1917684 - CVE-2021-3156 sudo: Heap buffer overflow in argument parsing\n\n6. ==========================================================================\nUbuntu Security Notice USN-4705-2\nJanuary 27, 2021\n\nsudo vulnerability\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 14.04 ESM\n- Ubuntu 12.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in Sudo. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. \n\nOriginal advisory details:\n\n It was discovered that Sudo incorrectly handled memory when parsing command\n lines. A local attacker could possibly use this issue to obtain unintended\n access to the administrator account. (CVE-2021-3156)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 14.04 ESM:\n sudo 1.8.9p5-1ubuntu1.5+esm6\n\nUbuntu 12.04 ESM:\n sudo 1.8.3p1-1ubuntu3.10\n\nIn general, a standard system update will make all the necessary changes. 8) - aarch64, ppc64le, s390x, x86_64\n\n3", "sources": [ { "db": "NVD", "id": "CVE-2021-3156" }, { "db": "VULHUB", "id": "VHN-383931" }, { "db": "PACKETSTORM", "id": "161139" }, { "db": "PACKETSTORM", "id": "162142" }, { "db": "PACKETSTORM", "id": "161143" }, { "db": "PACKETSTORM", "id": "161272" }, { "db": "PACKETSTORM", "id": "161163" }, { "db": "PACKETSTORM", "id": "161138" } ], "trust": 1.53 }, "exploit_availability": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "reference": "https://www.scap.org.cn/vuln/vhn-383931", "trust": 0.1, "type": "unknown" } ], "sources": [ { "db": "VULHUB", "id": "VHN-383931" } ] }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2021-3156", "trust": 1.7 }, { "db": "PACKETSTORM", "id": "161230", "trust": 1.1 }, { "db": "PACKETSTORM", "id": "161160", "trust": 1.1 }, { "db": "PACKETSTORM", "id": "161270", "trust": 1.1 }, { "db": "PACKETSTORM", "id": "161293", "trust": 1.1 }, { "db": "MCAFEE", "id": "SB10348", "trust": 1.1 }, { "db": "OPENWALL", "id": "OSS-SECURITY/2021/01/27/2", "trust": 1.1 }, { "db": "OPENWALL", "id": "OSS-SECURITY/2021/01/26/3", "trust": 1.1 }, { "db": "OPENWALL", "id": "OSS-SECURITY/2021/02/15/1", "trust": 1.1 }, { "db": "OPENWALL", "id": "OSS-SECURITY/2021/01/27/1", "trust": 1.1 }, { "db": "OPENWALL", "id": "OSS-SECURITY/2021/09/14/2", "trust": 1.1 }, { "db": "CERT/CC", "id": "VU#794544", "trust": 1.1 }, { "db": "OPENWALL", "id": "OSS-SECURITY/2024/01/30/8", "trust": 1.0 }, { "db": "OPENWALL", "id": "OSS-SECURITY/2024/01/30/6", "trust": 1.0 }, { "db": "PACKETSTORM", "id": "176932", "trust": 1.0 }, { "db": "PACKETSTORM", "id": "161163", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "161143", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "161138", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "161272", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "161139", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "161141", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "161152", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "161144", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "161140", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "161142", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "161398", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "161136", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "161135", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "161281", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "161137", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "161145", "trust": 0.1 }, { "db": "SEEBUG", "id": "SSVID-99117", "trust": 0.1 }, { "db": "VULHUB", "id": "VHN-383931", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "162142", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-383931" }, { "db": "PACKETSTORM", "id": "161139" }, { "db": "PACKETSTORM", "id": "162142" }, { "db": "PACKETSTORM", "id": "161143" }, { "db": "PACKETSTORM", "id": "161272" }, { "db": "PACKETSTORM", "id": "161163" }, { "db": "PACKETSTORM", "id": "161138" }, { "db": "NVD", "id": "CVE-2021-3156" } ] }, "id": "VAR-202101-1926", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-383931" } ], "trust": 0.01 }, "last_update_date": "2024-07-23T20:13:02.874000Z", "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-193", "trust": 1.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-383931" }, { "db": "NVD", "id": "CVE-2021-3156" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.2, "url": "http://www.openwall.com/lists/oss-security/2021/01/26/3" }, { "trust": 1.1, "url": "https://www.kb.cert.org/vuls/id/794544" }, { "trust": 1.1, "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-sudo-privesc-jan2021-qnyqfcm" }, { "trust": 1.1, "url": "https://security.netapp.com/advisory/ntap-20210128-0001/" }, { "trust": 1.1, "url": "https://security.netapp.com/advisory/ntap-20210128-0002/" }, { "trust": 1.1, "url": "https://support.apple.com/kb/ht212177" }, { "trust": 1.1, "url": "https://www.sudo.ws/stable.html#1.9.5p2" }, { "trust": 1.1, "url": "https://www.synology.com/security/advisory/synology_sa_21_02" }, { "trust": 1.1, "url": "https://www.debian.org/security/2021/dsa-4839" }, { "trust": 1.1, "url": "http://seclists.org/fulldisclosure/2021/jan/79" }, { "trust": 1.1, "url": "http://seclists.org/fulldisclosure/2021/feb/42" }, { "trust": 1.1, "url": "https://security.gentoo.org/glsa/202101-33" }, { "trust": 1.1, "url": "http://packetstormsecurity.com/files/161160/sudo-heap-based-buffer-overflow.html" }, { "trust": 1.1, "url": "http://packetstormsecurity.com/files/161230/sudo-buffer-overflow-privilege-escalation.html" }, { "trust": 1.1, "url": "http://packetstormsecurity.com/files/161270/sudo-1.9.5p1-buffer-overflow-privilege-escalation.html" }, { "trust": 1.1, "url": "http://packetstormsecurity.com/files/161293/sudo-1.8.31p2-1.9.5p1-buffer-overflow.html" }, { "trust": 1.1, "url": "https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability" }, { "trust": 1.1, "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "trust": 1.1, "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "trust": 1.1, "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "trust": 1.1, "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html" }, { "trust": 1.1, "url": "http://www.openwall.com/lists/oss-security/2021/01/27/1" }, { "trust": 1.1, "url": "http://www.openwall.com/lists/oss-security/2021/01/27/2" }, { "trust": 1.1, "url": "http://www.openwall.com/lists/oss-security/2021/02/15/1" }, { "trust": 1.1, "url": "http://www.openwall.com/lists/oss-security/2021/09/14/2" }, { "trust": 1.0, "url": "http://packetstormsecurity.com/files/176932/glibc-syslog-heap-based-buffer-overflow.html" }, { "trust": 1.0, "url": "http://seclists.org/fulldisclosure/2024/feb/3" }, { "trust": 1.0, "url": "http://www.openwall.com/lists/oss-security/2024/01/30/6" }, { "trust": 1.0, "url": "http://www.openwall.com/lists/oss-security/2024/01/30/8" }, { "trust": 1.0, "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10348" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/cala5ftxiqbrryua2zqnjxb6oqmaxeii/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/lhxk6ico5aylgfk2tax5mzkuxtukwojy/" }, { "trust": 0.5, "url": "https://access.redhat.com/security/cve/cve-2021-3156" }, { "trust": 0.5, "url": "https://bugzilla.redhat.com/):" }, { "trust": 0.5, "url": "https://nvd.nist.gov/vuln/detail/cve-2021-3156" }, { "trust": 0.5, "url": "https://access.redhat.com/security/team/contact/" }, { "trust": 0.4, "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.4, "url": "https://access.redhat.com/security/vulnerabilities/rhsb-2021-002" }, { "trust": 0.4, "url": "https://access.redhat.com/security/team/key/" }, { "trust": 0.4, "url": "https://access.redhat.com/articles/11258" }, { "trust": 0.4, "url": "https://access.redhat.com/security/updates/classification/#important" }, { "trust": 0.1, "url": "https://kc.mcafee.com/corporate/index?page=content\u0026amp;id=sb10348" }, { "trust": 0.1, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/lhxk6ico5aylgfk2tax5mzkuxtukwojy/" }, { "trust": 0.1, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/cala5ftxiqbrryua2zqnjxb6oqmaxeii/" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2021:0225" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17006" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-20907" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2021:1079" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-5188" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-12749" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-8625" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2017-12652" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-12401" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12402" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1971" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14866" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-15999" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2021-20228" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-7595" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20843" }, { "trust": 0.1, "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-17006" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17546" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-11719" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20388" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12401" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14973" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-17546" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-17023" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17023" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12243" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12749" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-6829" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-14866" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-8177" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-12403" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2017-12652" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12400" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-20388" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2021-3447" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19956" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11756" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-11756" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-12243" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-12400" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-5313" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2021-20191" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-11727" }, { "trust": 0.1, "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-1971" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11719" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-5094" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2021-20180" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11727" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12403" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-5188" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-15903" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15999" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-5094" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-15903" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-14973" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-19956" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-5313" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-17498" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-14422" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17498" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20907" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2021-20178" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14422" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2018-20843" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-12402" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2021:0221" }, { "trust": 0.1, "url": "https://access.redhat.com/articles/2974891" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25686" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25685" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25684" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25685" }, { "trust": 0.1, "url": "https://access.redhat.com/security/vulnerabilities/rhsb-2021-001" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25686" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25684" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2021:0395" }, { "trust": 0.1, "url": "https://usn.ubuntu.com/4705-2" }, { "trust": 0.1, "url": "https://usn.ubuntu.com/4705-1" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2021:0218" } ], "sources": [ { "db": "VULHUB", "id": "VHN-383931" }, { "db": "PACKETSTORM", "id": "161139" }, { "db": "PACKETSTORM", "id": "162142" }, { "db": "PACKETSTORM", "id": "161143" }, { "db": "PACKETSTORM", "id": "161272" }, { "db": "PACKETSTORM", "id": "161163" }, { "db": "PACKETSTORM", "id": "161138" }, { "db": "NVD", "id": "CVE-2021-3156" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-383931" }, { "db": "PACKETSTORM", "id": "161139" }, { "db": "PACKETSTORM", "id": "162142" }, { "db": "PACKETSTORM", "id": "161143" }, { "db": "PACKETSTORM", "id": "161272" }, { "db": "PACKETSTORM", "id": "161163" }, { "db": "PACKETSTORM", "id": "161138" }, { "db": "NVD", "id": "CVE-2021-3156" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2021-01-26T00:00:00", "db": "VULHUB", "id": "VHN-383931" }, { "date": "2021-01-27T14:06:12", "db": "PACKETSTORM", "id": "161139" }, { "date": "2021-04-09T15:06:13", "db": "PACKETSTORM", "id": "162142" }, { "date": "2021-01-27T14:06:46", "db": "PACKETSTORM", "id": "161143" }, { "date": "2021-02-03T16:22:29", "db": "PACKETSTORM", "id": "161272" }, { "date": "2021-01-28T13:59:34", "db": "PACKETSTORM", "id": "161163" }, { "date": "2021-01-27T14:06:02", "db": "PACKETSTORM", "id": "161138" }, { "date": "2021-01-26T21:15:12.987000", "db": "NVD", "id": "CVE-2021-3156" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-09-03T00:00:00", "db": "VULHUB", "id": "VHN-383931" }, { "date": "2024-07-09T18:27:53.967000", "db": "NVD", "id": "CVE-2021-3156" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "PACKETSTORM", "id": "161163" } ], "trust": 0.1 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Red Hat Security Advisory 2021-0225-01", "sources": [ { "db": "PACKETSTORM", "id": "161139" } ], "trust": 0.1 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "overflow, root", "sources": [ { "db": "PACKETSTORM", "id": "161139" }, { "db": "PACKETSTORM", "id": "161143" }, { "db": "PACKETSTORM", "id": "161138" } ], "trust": 0.3 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.