СloudLinux Blog

A new sudo package with the CVE-2021-3156 fix within CentOS 6 Extended Lifecycle Support has been rolled out to 100%

Written by Inessa Atmachian | Jan 28, 2021 8:33:54 AM

A new sudo package with the CVE-2021-3156 fix within CentOS 6 extended lifecycle support has been rolled out to 100% and is now available for download from our production repository.

Errata: https://errata.cloudlinux.com/els6/CLSA-2021-1611743864.html

Changelog

sudo-1.8.6p3-30.cloudlinux.els6

  • Fixed Heap-based buffer overflow in Sudo (CVE-2021-3156)

Update command

yum update sudo*

CVE-2021-3156 description

Sudo before 1.9.5p2 has a Heap-based Buffer Overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.