In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability. See also: https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2093dfc8d64428ba30f367271407fd9fe4dd2835 commit 2093dfc8d64428ba30f367271407fd9fe4dd2835 Author: Craig Andrews <candrews@gentoo.org> AuthorDate: 2024-04-15 13:44:17 +0000 Commit: Craig Andrews <candrews@gentoo.org> CommitDate: 2024-04-15 13:44:23 +0000 net-analyzer/netdata: add 1.45.3 Bug: https://bugs.gentoo.org/930066 Signed-off-by: Craig Andrews <candrews@gentoo.org> net-analyzer/netdata/Manifest | 1 + net-analyzer/netdata/netdata-1.45.3.ebuild | 163 +++++++++++++++++++++++++++++ 2 files changed, 164 insertions(+)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6732715cb4cbba421e42a48a1a8c9436bc2888fc commit 6732715cb4cbba421e42a48a1a8c9436bc2888fc Author: Craig Andrews <candrews@gentoo.org> AuthorDate: 2024-04-15 14:10:57 +0000 Commit: Craig Andrews <candrews@gentoo.org> CommitDate: 2024-04-15 14:11:17 +0000 net-analyzer/netdata: drop 1.44.0, 1.45.0, 1.45.1, 1.45.2 Bug: https://bugs.gentoo.org/930066 Signed-off-by: Craig Andrews <candrews@gentoo.org> net-analyzer/netdata/Manifest | 4 - net-analyzer/netdata/netdata-1.44.0.ebuild | 170 ----------------------------- net-analyzer/netdata/netdata-1.45.0.ebuild | 155 -------------------------- net-analyzer/netdata/netdata-1.45.1.ebuild | 155 -------------------------- net-analyzer/netdata/netdata-1.45.2.ebuild | 163 --------------------------- 5 files changed, 647 deletions(-)
All done. Thanks for the quick action!
