sudo 1.9.15rc3 released

--===============4532726287467273910==
Content-Type: multipart/signed; protocol="application/pgp-signature";
  micalg=pgp-; boundary="78731_Thu_Nov__2_16_28_05_MDT_2023"

--78731_Thu_Nov__2_16_28_05_MDT_2023
Content-Type: text/plain; charset=us-ascii

The third (and hopefully final) release candidate for sudo 1.9.15
is now available.  In addition to bug fixes, sudo 1.9.15 includes
changes to make it easier to determine which sudoers rule permitted
a command to be run.

Source:
    https://www.sudo.ws/dist/beta/sudo-1.9.15rc3.tar.gz
    ftp://ftp.sudo.ws/pub/sudo/beta/sudo-1.9.15rc3.tar.gz

SHA256 checksum:
    217e4b701ac0526bbbfbfc448e528d0e64478b3a7a590a5c70d96fd0b6603aaa

MD5 checksum:
    5c4357d4b1402433d93e5087820792d8

Binary packages:
    https://www.sudo.ws/getting/beta_packages/

For a list of download mirror sites, see:
    https://www.sudo.ws/getting/download_mirrors/

Sudo web site:
    https://www.sudo.ws/

Major changes between sudo 1.9.15rc3 and 1.9.15rc2:

 * Better log message when rejecting a command if the "intercept"
   option is enabled and the "intercept_allow_setid" option is
   disabled.  Previously, "command not allowed" would be logged and
   the user had no way of knowing what the actual problem was.

 * Quieted a few minor Coverity warnings.

Major changes between sudo 1.9.15rc2 and 1.9.15rc1:

 * Fixed compilation errors with the Kerberos V and SIA authentication
   methods.  Kerberos V support is now built as part of the CI pipeline.

Major changes between sudo 1.9.15rc1 and 1.9.15b2:

 * The "sudo_logsrvd" server will now raise its open file descriptor
   limit to the maximum allowed value when it starts up.  Each
   connection can require up to nine open file descriptors so the
   default soft limit may be too low.

 * Updated translations from translationproject.org.

Major changes between sudo 1.9.15b2 and 1.9.15b1:

 * New Indonesian translation from translationproject.org.

 * Updated translations from translationproject.org.

 * Sudo will now log the invoking user's environment as "submitenv"
   in the JSON logs.  The command's environment ("runenv") is no
   longer logged for commands rejected by the sudoers file or an
   approval plugin.

 * Reverted a change from sudo 1.9.4 that resulted in PAM session
   modules being called with the environment of the command to be
   run instead of the environment of the invoking user.
   GitHub issue #318.

Major changes between sudo 1.9.15b1 and 1.9.14p3:

 * Fixed an undefined symbol problem on older versions of macOS
   when "intercept" or "log_subcmds" are enabled in sudoers.
   GitHub issue #276.

 * Fixed "make check" failure related to getpwent(3) wrapping
   on NetBSD.

 * Fixed the warning message for "sudo -l command" when the command
   is not permitted.  There was a missing space between "list" and
   the actual command due to changes in sudo 1.9.14.

 * Fixed a bug where output could go to the wrong terminal if
   "use_pty" is enabled (the default) and the standard input, output
   or error is redirected to a different terminal.  Bug #1056.

 * The visudo utility will no longer create an empty file when the
   specified sudoers file does not exist and the user exits the
   editor without making any changes.  GitHub issue #294.

 * The AIX and Solaris sudo packages on www.sudo.ws now support
   "log_subcmds" and "intercept" with both 32-bit and 64-bit
   binaries.  Previously, they only worked when running binaries
   with the same word size as the sudo binary.  GitHub issue #289.

 * The sudoers source is now logged in the JSON event log.  This
   makes it possible to tell which rule resulted in a match.

 * Running "sudo -ll command" now produces verbose output that
   includes matching rule as well as the path to the sudoers file
   the matching rule came from.  For LDAP sudoers, the name of the
   matching sudoRole is printed instead.

 * The embedded copy of zlib has been updated to version 1.3.

 * The sudoers plugin has been modified to make it more resilient
   to ROWHAMMER attacks on authentication and policy matching.
   This addresses CVE-2023-42465.

 * The sudoers plugin now constructs the user time stamp file path
   name using the user-ID instead of the user name.  This avoids a
   potential problem with user names that contain a path separator
   ('/') being interpreted as part of the path name.  A similar
   issue in sudo-rs has been assigned CVE-2023-42456.

 * A path separator ('/') in a user, group or host name is now
   replaced with an underbar character ('_') when expanding escapes
   in @include and @includedir directives as well as the "iolog_file"
   and "iolog_dir" sudoers Default settings.

 * The "intercept_verify" sudoers option is now only applied when
   the "intercept" option is set in sudoers.  Previously, it was
   also applied when "log_subcmds" was enabled.  Sudo 1.9.14
   contained an incorrect fix for this.  Bug #1058.

 * Changes to terminal settings are now performed atomically, where
   possible.  If the command is being run in a pseudo-terminal and
   the user's terminal is already in raw mode, sudo will not change
   the user's terminal settings.  This prevents concurrent sudo
   processes from restoring the terminal settings to the wrong values.
   GitHub issue #312.

--78731_Thu_Nov__2_16_28_05_MDT_2023
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEWdHpzLorN2cE/dNbqfTAIc6kcPsFAmVEInUACgkQqfTAIc6k
cPvokA/+OlsGlz9RKGX1PjGPcqJfvbRM6rKrX1sqKP83wRKAN8ay23ZJbtaxK0Aq
LLIWKwkHJO4Lm0q3Vx07MEYbTgNIElhot0y1baX5IqfcYIs6nTQJBo7R1AykEIF9
xON+XPvzSDPSx3q48JMETE3U7BEBFa+jd2gIQ7FO9iLCBm6Xw5JLImoObqrnXR6c
6Po5EDRThKS8WYq9giSx5FkILaDS7J2dtd1GFbGqE5UUojijX2o9CoQSgg5Ycghh
Xb6fU8T5/XkFIJru6/16UxN1AZw+8M3NfpJrEl+uJNLks/UbXouhM+1I0Q+UwiRW
pvq9N+9AG/lfiz1VxYoFKUbdJygWwj851MuDDqxz5xD850s0UAq5FxsSA7lEH0EA
CTGcILzJZw737mhKYYKNQwc2o4rZdPLvYlFDdj0sMgzlH//A9xvmBks1on8elrE1
2Ewj/j2j5WjApULdlatrj0+ZbBGz8M+vTgodTBV2Eofyh41wF++hwIPK9ZO90VDv
Bgn6/SxBVV1j/nGKThBYTBDaxdF72Swy2B6H+trsueEt1ahstJIMPhfThAgBiZQg
5kigXE6qGVu27zZvIP1zDPi8N4UKJHT4v5uS60J+3h1nAyIRXLrTWTiNw3hDoKle
bzSCl2ZOI+eMp1ROnPCsr3RG/PJB6Ye6zE+OOOPf544wVM5RK9E=
=QTSM
-----END PGP SIGNATURE-----

--78731_Thu_Nov__2_16_28_05_MDT_2023--


--===============4532726287467273910==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers

--===============4532726287467273910==--