Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1307304

Bug#1146136: sudo: CVE-2026-82474

Show all headers | View raw

Control: tags -1 security upstream wontfix
thanks

On Sun, Aug 30, 2026 at 10:53:06AM +0200, Salvatore Bonaccorso wrote:
> The following vulnerability was published for sudo.
> 
> CVE-2026-82474[0]:
> | Sudo through 1.9.17p2 fails to apply intercept policy checks to the
> | execveat system call in ptrace-based intercept mode. Users permitted
> | to run specific commands can execute denied programs by calling
> | execveat directly or through fexecve, bypassing policy enforcement
> | and logging.
> 
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

We talked about this offline and decided neither to do a DSA nor to pull 
the upstream fix for forky.

Tagging this wontfix, will close it with the next upstream release.

Greetings
Marc

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1146136: sudo: CVE-2026-82474 Salvatore Bonaccorso <carnil@debian.org> - 2026-08-30 11:00 +0200
  Bug#1146136: sudo: CVE-2026-82474 Marc Haber <mh+debian-packages@zugschlus.de> - 2026-08-31 19:50 +0200
    Bug#1146136: sudo: CVE-2026-82474 Salvatore Bonaccorso <carnil@debian.org> - 2026-08-31 21:20 +0200

csiph-web