CVE-2023-27320 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.2 HIGH	NETWORK	LOW	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
mitre	CNA	---				---
CVE	ADP	---				---
CISA-ADP	ADP	7.2 HIGH	NETWORK	LOW	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 38%

Vendor	Product	Version
sudo_project	sudo	1.9.8 ≤ 𝑥 < 1.9.13
sudo_project	sudo	1.9.13
sudo_project	sudo	1.9.13:p1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

sudo

bullseye (security)	1.9.5p2-3+deb11u1 fixed
bullseye	1.9.5p2-3+deb11u1 not-affected
buster	not-affected
bookworm	1.9.13p3-1+deb12u1 fixed
sid	1.9.16p1-1 fixed
trixie	1.9.16p1-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

sudo

lunar	Fixed 1.9.13p1-1ubuntu2 released
kinetic	Fixed 1.9.11p3-1ubuntu1.2 released
jammy	Fixed 1.9.9-1ubuntu2.3 released
focal	not-affected
bionic	not-affected
xenial	not-affected
trusty	not-affected

Known Exploits!

Common Weakness Enumeration

CWE-415 - Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References

http://www.openwall.com/lists/oss-security/2023/03/01/8

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/332KN4QI6QXB7NI7SWSJ2EQJKWIILFN6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLXMRAMXC3BYL4DNKVTK3V6JDMUXZ7B/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6VW24YGXJYI4NZ5HZPQCF4MCE7766AU/

https://security.gentoo.org/glsa/202309-12

https://security.netapp.com/advisory/ntap-20230413-0009/

https://www.openwall.com/lists/oss-security/2023/02/28/1

https://www.sudo.ws/releases/stable/#1.9.13p2

http://www.openwall.com/lists/oss-security/2023/03/01/8

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/332KN4QI6QXB7NI7SWSJ2EQJKWIILFN6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLXMRAMXC3BYL4DNKVTK3V6JDMUXZ7B/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6VW24YGXJYI4NZ5HZPQCF4MCE7766AU/

https://security.gentoo.org/glsa/202309-12

https://security.netapp.com/advisory/ntap-20230413-0009/

https://www.openwall.com/lists/oss-security/2023/02/28/1

https://www.sudo.ws/releases/stable/#1.9.13p2