CVE-2015-8239
UnknownEPSS 0.54%
Last modified
CVE-2015-8239 is a vulnerability of currently unknown severity. The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.. EPSS estimates a 0.54% chance of exploitation in the next 30 days.
Description
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sudo Project | Sudo | 1.8.8 |
| Sudo Project | Sudo | 1.8.9 |
| Sudo Project | Sudo | 1.8.10 |
| Sudo Project | Sudo | 1.8.11 |
| Sudo Project | Sudo | 1.8.12 |
| Sudo Project | Sudo | 1.8.13 |
| Sudo Project | Sudo | 1.8.14 |
| Sudo Project | Sudo | 1.8.15 |
References
- http://www.openwall.com/lists/oss-security/2015/11/18/22Mailing List, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1283635Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/0cd3cc8fa195Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/24a3d9215c64Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/397722cdd7ecIssue Tracking, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/11/18/22Mailing List, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1283635Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/0cd3cc8fa195Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/24a3d9215c64Issue Tracking, Patch, Third Party Advisory
- https://www.sudo.ws/repos/sudo/rev/397722cdd7ecIssue Tracking, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-8239?
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
How severe is CVE-2015-8239?
Severity scoring for CVE-2015-8239 is pending analysis. The EPSS model estimates a 0.54% probability of exploitation in the next 30 days.
How do I fix CVE-2015-8239?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-8231Huawei eSpace 7910 and 7950 IP phones with software before V…
- CVE-2015-8232The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does…
- CVE-2015-8233Cross-site scripting (XSS) vulnerability in the MAYO theme 7…
- CVE-2015-8234The image signature algorithm in OpenStack Glance 11.0.0 all…
- CVE-2015-8235Directory traversal vulnerability in Spiffy before 5.4.
- CVE-2015-8236Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before …
- CVE-2015-8240The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, A…
- CVE-2015-8241The xmlNextChar function in libxml2 2.9.2 does not properly …
- CVE-2015-8242The xmlSAX2TextNode function in SAX2.c in the push interface…
- CVE-2015-8247Cross-site scripting (XSS) vulnerability in synnefoclient in…
- CVE-2015-8248Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2015-8249The FileUploadServlet class in ManageEngine Desktop Central …
Are you affected by CVE-2015-8239?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST