901393 – (CVE-2023-28339) app-admin/doas: vulnerable to privilege escalation via TIOCSTI/TIOCLINUX command injection

Bug 901393 (CVE-2023-28339) - app-admin/doas: vulnerable to privilege escalation via TIOCSTI/TIOCLINUX command injection

Summary: app-admin/doas: vulnerable to privilege escalation via TIOCSTI/TIOCLINUX comm...

Status:	CONFIRMED

Alias:	CVE-2023-28339

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal major (vote)
Assignee:	Gentoo Security

URL:	https://github.com/Duncaen/OpenDoas/i...
Whiteboard:	B1 [upstream]
Keywords:

Depends on:
Blocks:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sebastian Pipping gentoo-dev

2023-03-15 23:36:42 UTC

See URL for details and demo, please.  Unfixed upstream.

Reproducible: Always

Comment 1 Sam James archtester

2023-03-16 19:58:43 UTC

(remember to CC maintainers if you can)

thanks!

Comment 2 Sebastian Pipping gentoo-dev

2023-03-16 20:07:45 UTC

(In reply to Sam James from comment #1)
> (remember to CC maintainers if you can)

Didn't think of it, sorry.  Good point, thanks!