CVE-2015-8239
HIGH 7.0EPSS 0.5%
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
- CVSS v3.0 NVD
- 7.0 HIGH
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 6.9 MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C - EPSS
- 0.54% chance of exploitation in the next 30 days, 44th percentile
- Published
- 2017-10-10
- Updated
- 2024-08-06
Proof-of-concept exploits (1)
- justinsteven/sudo_digest_toctou_poc_CVE-2015-82390★ · 2021-01-15
Security advisories
- http://www.openwall.com/lists/oss-security/2015/11/18/22
- https://bugzilla.redhat.com/show_bug.cgi?id=1283635
- https://www.sudo.ws/repos/sudo/rev/0cd3cc8fa195
- https://www.sudo.ws/repos/sudo/rev/24a3d9215c64
- https://www.sudo.ws/repos/sudo/rev/397722cdd7ec