This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============8792207321763265000==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="iQCNToxY7PCu8WgHgCMLPhA1ZbzhgRhSN"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--iQCNToxY7PCu8WgHgCMLPhA1ZbzhgRhSN
Content-Type: multipart/mixed;
 boundary="pQrO0Nu3JVKn3gKiRcWdfn2X1AMnOqm9s";
 protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: "ubuntu-security-announce@lists.ubuntu.com"
 <ubuntu-security-announce@lists.ubuntu.com>
Message-ID: <f8f74de9-c1cd-fdf1-3596-52c7594fe8cd@canonical.com>
Subject: [USN-4705-1] Sudo vulnerabilities

--pQrO0Nu3JVKn3gKiRcWdfn2X1AMnOqm9s
Content-Type: text/plain; charset=utf-8
Content-Language: en-C
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-4705-1
January 26, 2021

sudo vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Sudo.

Software Description:
- sudo: Provide limited super user privileges to specific users

Details:

It was discovered that Sudo incorrectly handled memory when parsing command
lines. A local attacker could possibly use this issue to obtain unintended
access to the administrator account. (CVE-2021-3156)

It was discovered that the Sudo sudoedit utility incorrectly handled
checking directory permissions. A local attacker could possibly use this
issue to bypass file permissions and determine if a directory exists or
not.  (CVE-2021-23239)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  sudo                            1.9.1-1ubuntu1.1
  sudo-ldap                       1.9.1-1ubuntu1.1

Ubuntu 20.04 LTS:
  sudo                            1.8.31-1ubuntu1.2
  sudo-ldap                       1.8.31-1ubuntu1.2

Ubuntu 18.04 LTS:
  sudo                            1.8.21p2-3ubuntu1.4
  sudo-ldap                       1.8.21p2-3ubuntu1.4

Ubuntu 16.04 LTS:
  sudo                            1.8.16-0ubuntu1.10
  sudo-ldap                       1.8.16-0ubuntu1.10

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/4705-1
  CVE-2021-23239, CVE-2021-3156

Package Information:
  https://launchpad.net/ubuntu/+source/sudo/1.9.1-1ubuntu1.1
  https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2
  https://launchpad.net/ubuntu/+source/sudo/1.8.21p2-3ubuntu1.4
  https://launchpad.net/ubuntu/+source/sudo/1.8.16-0ubuntu1.10


--pQrO0Nu3JVKn3gKiRcWdfn2X1AMnOqm9s--

--iQCNToxY7PCu8WgHgCMLPhA1ZbzhgRhSN
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmAQbRAACgkQZWnYVadE
vpPn7Q//fgAaPpbEcKrvs3ZNAASHczcPtanuTOWusEuEwenpEme9j8VI2J4zKDHJ
Fp8ZFGiI5EjzUyBa/uIxsAwqjCi3SgrkfT4WYOQGHhTaGlP+yD7NKDsHmrYYYNrZ
fgE5JD/AqFeI+5qWQhBgFZDbRaTrcm93SSRIgnZLQPWef7qBHdJZ6fG6hsnIFg4S
n8nf5BNgBmstwRJH4+PPpLUOL/hqniSn+RXdADSqfMM/Z1e7kgXdXsAQtG/XXDn0
GU3lkti6X2PNbgxjRCxL31i2vDWo2e2LlaooUVuMwqDS7rSI8i+4jjvafYMGvNkG
/rEMVJDQkvJmv/N1b36PdsTd5jd7eYHChtvawjTIcEBS85KYCGUpl88RLyvPx4tl
rjE80FYj/r8fWLppklyBHX5eMOWq8mZC4LSxcxomFS4So7gXn31tTAyKdF6k/w+F
St5GnKNxIY73F4noNsyERm0oJpcFvsE/+sr93+WwnhIkjXQ7n66ThQb9FkLBParP
LQPUITyVqKSdD8ShPK2+SS7sdSzYoEUlsWa34lqv2LMVydXRJKSxqDOM8hpO18fm
RwH2WuJXKFQe0g2bBGEUysV1qbBaxADyCe9dh09RVvVJcvaskO+7Hi49ROPNKgz5
rWc0kMUqOCFR2UeSw5PSAlt8njLtTdVy4XWAERUQQ6Fh9wJz/lM=
=UWCD
-----END PGP SIGNATURE-----

--iQCNToxY7PCu8WgHgCMLPhA1ZbzhgRhSN--


--===============8792207321763265000==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============8792207321763265000==--