CVE-2019-18634
Public on 2020-01-29
        Modified on 2020-03-18
        
      Description
            
              A flaw was found in the Sudo application when the ’pwfeedback' option is set to true on the sudoers file. An authenticated user can use this vulnerability to trigger a stack-based buffer overflow under certain conditions even without Sudo privileges. The buffer overflow may allow an attacker to expose or corrupt memory information, crash the Sudo application, or possibly inject code to be run as a root user.
            
          Severity
          
          See what this means
        CVSS v3 Base Score
          
          See breakdown
        Affected Packages
| Platform | Package | Release Date | Advisory | Status | 
|---|---|---|---|---|
| Amazon Linux 1 | sudo | 2020-03-16 | ALAS-2020-1356 | Fixed | 
| Amazon Linux 2 - Core | sudo | 2020-03-16 | ALAS2-2020-1404 | Fixed | 
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | 
| NVD | CVSSv2 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P | 
| NVD | CVSSv3 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |