OpenDoas: Insufficient environment filtering

OpenDoas: Insufficient environment filtering A vulnerability in OpenDoas could lead to privilege escalation. doas 2021-07-07 2021-07-07 767781 local 6.8.1 6.8.1

OpenDoas allows users to run commands as other users.

OpenDoas does not properly filter the PATH variable from the resulting shell after escalating privileges.

A local attacker with control of a user’s PATH variable could escalate privileges if that user uses OpenDoas with a poisoned PATH variable.

There is no known workaround at this time.

All OpenDoas users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=app-admin/doas-6.8.1"

CVE-2019-25016 ajak ajak