sudo 1.9.15rc1 released

--===============6073818763701866460==
Content-Type: multipart/signed; protocol="application/pgp-signature";
  micalg=pgp-; boundary="61902_Mon_Oct_30_19_25_46_MDT_2023"

--61902_Mon_Oct_30_19_25_46_MDT_2023
Content-Type: text/plain; charset=us-ascii

The first release candidate for sudo 1.9.15 is now available.  In
addition to bug fixes, sudo 1.9.15 includes changes to make it
easier to determine which sudoers rule permitted a command to be
run.

Source:
    https://www.sudo.ws/dist/beta/sudo-1.9.15rc1.tar.gz
    ftp://ftp.sudo.ws/pub/sudo/beta/sudo-1.9.15rc1.tar.gz

SHA256 checksum:
    612f677f4635eb3d8322a12e1630f055a4da5a66826610ce5b3dce8a63a212c3

MD5 checksum:
    f9c799cd48e43c646b29c2cfffca41ae

Binary packages:
    https://www.sudo.ws/getting/beta_packages/

For a list of download mirror sites, see:
    https://www.sudo.ws/getting/download_mirrors/

Sudo web site:
    https://www.sudo.ws/

Major changes between sudo 1.9.15rc1 and 1.9.15b2:

 * The "sudo_logsrvd" server will now raise its open file descriptor
   limit to the maximum allowed value when it starts up.  Each
   connection can require up to nine open file descriptors so the
   default soft limit may be too low.

 * Updated translations from translationproject.org.

Major changes between sudo 1.9.15b2 and 1.9.15b1:

 * New Indonesian translation from translationproject.org.

 * Updated translations from translationproject.org.

 * Sudo will now log the invoking user's environment as "submitenv"
   in the JSON logs.  The command's environment ("runenv") is no
   longer logged for commands rejected by the sudoers file or an
   approval plugin.

 * Reverted a change from sudo 1.9.4 that resulted in PAM session
   modules being called with the environment of the command to be
   run instead of the environment of the invoking user.
   GitHub issue #318.

Major changes between sudo 1.9.15b1 and 1.9.14p3:

 * Fixed an undefined symbol problem on older versions of macOS
   when "intercept" or "log_subcmds" are enabled in sudoers.
   GitHub issue #276.

 * Fixed "make check" failure related to getpwent(3) wrapping
   on NetBSD.

 * Fixed the warning message for "sudo -l command" when the command
   is not permitted.  There was a missing space between "list" and
   the actual command due to changes in sudo 1.9.14.

 * Fixed a bug where output could go to the wrong terminal if
   "use_pty" is enabled (the default) and the standard input, output
   or error is redirected to a different terminal.  Bug #1056.

 * The visudo utility will no longer create an empty file when the
   specified sudoers file does not exist and the user exits the
   editor without making any changes.  GitHub issue #294.

 * The AIX and Solaris sudo packages on www.sudo.ws now support
   "log_subcmds" and "intercept" with both 32-bit and 64-bit
   binaries.  Previously, they only worked when running binaries
   with the same word size as the sudo binary.  GitHub issue #289.

 * The sudoers source is now logged in the JSON event log.  This
   makes it possible to tell which rule resulted in a match.

 * Running "sudo -ll command" now produces verbose output that
   includes matching rule as well as the path to the sudoers file
   the matching rule came from.  For LDAP sudoers, the name of the
   matching sudoRole is printed instead.

 * The embedded copy of zlib has been updated to version 1.3.

 * The sudoers plugin has been modified to make it more resilient
   to ROWHAMMER attacks on authentication and policy matching.
   This addresses CVE-2023-42465.

 * The sudoers plugin now constructs the user time stamp file path
   name using the user-ID instead of the user name.  This avoids a
   potential problem with user names that contain a path separator
   ('/') being interpreted as part of the path name.  A similar
   issue in sudo-rs has been assigned CVE-2023-42456.

 * A path separator ('/') in a user, group or host name is now
   replaced with an underbar character ('_') when expanding escapes
   in @include and @includedir directives as well as the "iolog_file"
   and "iolog_dir" sudoers Default settings.

 * The "intercept_verify" sudoers option is now only applied when
   the "intercept" option is set in sudoers.  Previously, it was
   also applied when "log_subcmds" was enabled.  Sudo 1.9.14
   contained an incorrect fix for this.  Bug #1058.

 * Changes to terminal settings are now performed atomically, where
   possible.  If the command is being run in a pseudo-terminal and
   the user's terminal is already in raw mode, sudo will not change
   the user's terminal settings.  This prevents concurrent sudo
   processes from restoring the terminal settings to the wrong values.
   GitHub issue #312.

--61902_Mon_Oct_30_19_25_46_MDT_2023
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEWdHpzLorN2cE/dNbqfTAIc6kcPsFAmVAV5oACgkQqfTAIc6k
cPsGjA/+KkpBFXoA68w4d0zjlSQFS28OY06oWCfEXAJQQyLCouLLqb4rWBkIWq5N
kfC8ECwFnlVzSOKW0ClopITvj31iFcJYt6rXMIYJE8R6l+NLuZJEt1NmhWKvZXjN
BbrEnc5XlmsDh+JHNrjLTopa3jwZTPPywTkGa2hbzE+xq2DEN/misrmp9ZKoad43
38TQ63QsDIxiiIM2IMI9/pMqzVRU7Pla3qDy5FyIOhSPDXtLTBQ4BoJVyHpcSI35
dsB9BhhFHnAU9Ga0IlrF4Sn7Yt/i2VYzYauSj/XUhD0iGMWx6rzGzcB33S78oE30
K/zfse5Ke70m1QWh6HhEMrEaZsl6LepXfQL4N5J5gyH3FdsZwYUeWqKxtirrFV4J
IR20R8Fa5Rp0AXOWf5YI854/8Jb/ozJot3u3kq/uir/CSD2N0pD+qCMEBxSWH5Nb
JYskmOM6W6y50nGgrefNFkW1fF+kR4ppQfgQypxXk74GeAUED+hLtyn5rNOcayXy
d+PALnbWj7rEg8dVwivH+J5WmksfVNmhMQaEcBaZe4LhHi0cWeJPjc2Fn+lRF+qC
H22gRHY1r7V6dp2sTW4pbGomS1c34lqvkgpcGWW9JiF5ATLvzR7oe7Yu60oqN7w8
Um2WPaTNjw9hsN6fhLXe8GN6hzffOTuExf/XmoDSgc3BoQB8FFM=
=upvm
-----END PGP SIGNATURE-----

--61902_Mon_Oct_30_19_25_46_MDT_2023--


--===============6073818763701866460==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers

--===============6073818763701866460==--