Code injection

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9...

UBUNTU-CVE-2023-28531

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9...

CVE-2023-28531

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9...

CVE-2023-28531

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9...

Double Free

sudo is vulnerable to Double Free. An attacker can trigger a double free in the per-command chroot feature...

Information Disclosure

jenkins-2-plugins is vulnerable to Information Disclosure. An attacker with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins...

Sudo before 1.9.13p2 has a double free in the per-command chroot feature.

...

SUSE CVE-2023-27320

Sudo before 1.9.13p2 has a double free in the per-command chroot feature...

Fedora 37 : sudo (2023-d2d6ec2a32)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d2d6ec2a32 advisory. Security fix for CVE-2023-27320 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

USN-5908-1 sudo vulnerability

It was discovered that Sudo incorrectly handled the per-command chroot feature. In certain environments where Sudo is configured with a rule that contains a CHROOT setting, a local attacker could use this issue to cause Sudo to crash, resulting in a denial of service, or possibly escalate...

CVE-2023-27320

A double-free vulnerability was found in Sudo in the per-command chroot feature. This flaw exists due to a boundary error when matching a sudoer rule that contains a per-command chroot directive CHROOT=dir. By sending a specially-crafted request, a local privileged attacker can elevate privileges...

AZL-13784 CVE-2023-27320 affecting package sudo for versions less than 1.9.13p3-1

Sudo before 1.9.13p2 has a double free in the per-command chroot feature...

DEBIAN-CVE-2023-27320

Sudo before 1.9.13p2 has a double free in the per-command chroot feature...

CVE-2023-27320

Sudo before 1.9.13p2 has a double free in the per-command chroot feature...

UBUNTU-CVE-2023-27320

Sudo before 1.9.13p2 has a double free in the per-command chroot feature...

CVE-2023-27320

Sudo before 1.9.13p2 has a double free in the per-command chroot feature...

CVE-2023-27320

Sudo before 1.9.13p2 has a double free in the per-command chroot feature...

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb" making curl end up spending enormous amounts of allocated heap memory or trying to and returning out of memory errors.

...

plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins...

Gcore Thwarts Massive 650 Gbps DDoS Attack on Free Plan Client

At the beginning of January, Gcore faced an incident involving several L3/L4 DDoS attacks with a peak volume of 650 Gbps. Attackers exploited over 2000 servers belonging to one of the top three cloud providers worldwide and targeted a client who was using a free CDN plan. However, due to Gcore's...