7.8
Élevée
CVE-2026-96512 A flaw was found in sudo
Description
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Enterprise Linux 10 | Versions non publiées | |
| Red Hat Enterprise Linux 9 | Versions non publiées | |
| Red Hat Hardened Images 1.9 | premières → < 1.9.17-16.p2.2.hum1 | 1.9.17-16.p2.2.hum1 |
| Red Hat Enterprise Linux 7 | Versions non publiées | |
| Red Hat Enterprise Linux 8 | Versions non publiées | |
| Red Hat Update Infrastructure 5 1791978693 | premières → < 1791978693 | 1791978693 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions non publiées | |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | Versions non publiées | |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | Versions non publiées |
Afficher les 10 autres branches Masquer les 10 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | Versions non publiées | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions non publiées | |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | Versions non publiées | |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | Versions non publiées | |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | Versions non publiées | |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | Versions non publiées | |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | Versions non publiées | |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | Versions non publiées | |
| Red Hat OpenShift AI 3.0 1793041981 | premières → < 1793041981 | 1793041981 |
| Red Hat OpenShift AI 3.4 1793041995 | premières → < 1793041995 | 1793041995 |
Références
- RHSA-2026:71609 access.redhat.com
- RHSA-2026:75571 access.redhat.com
- RHSA-2026:75579 access.redhat.com
- RHSA-2026:75580 access.redhat.com
- RHSA-2026:82939 access.redhat.com
- RHSA-2026:86633 access.redhat.com
- RHSA-2026:86634 access.redhat.com
- RHSA-2026:86635 access.redhat.com
- RHSA-2026:87026 access.redhat.com
- RHSA-2026:90287 access.redhat.com
- RHSA-2026:91217 access.redhat.com
- RHSA-2026:91219 access.redhat.com
- RHSA-2026:91244 access.redhat.com
- RHSA-2026:92325 access.redhat.com
- RHSA-2026:92326 access.redhat.com
- RHSA-2026:92349 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2539327 bugzilla.redhat.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Enterprise Linux 10
Les 1454 CVE de Red Hat Enterprise Linux 10 →
CVE-2026-123151
Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail
Non notée
CVE-2026-121997
Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch
8.1
Élevée
CVE-2026-121996
Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length
8.2
Élevée
CVE-2026-121995
Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail
7.5
Élevée