#1034185 opendoas: CVE-2023-28339

Package:
src:opendoas
Source:
src:opendoas
Submitter:
Moritz Mühlenhoff
Date:
2023-04-10 18:54:14 UTC
Severity:
normal
Tags:
#1034185#5
Date:
2023-04-10 17:43:03 UTC
From:
To:
Hi,

The following vulnerability was published for opendoas.

CVE-2023-28339[0]:
| OpenDoas through 6.8.2, when TIOCSTI is available, allows privilege
| escalation because of sharing a terminal with the original session.
| NOTE: TIOCSTI is unavailable in OpenBSD 6.0 and later, and can be made
| unavailable in the Linux kernel 6.2 and later.

https://github.com/Duncaen/OpenDoas/issues/106
https://www.openwall.com/lists/oss-security/2023/03/14/4

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-28339
https://www.cve.org/CVERecord?id=CVE-2023-28339

Please adjust the affected versions in the BTS as needed.