sudo 1.9.18b3 released

--===============1603515060459786346==
Content-Type: multipart/signed; protocol="application/pgp-signature";
  micalg=pgp-; boundary="80036_Sun_Dec_28_09_49_23_MST_2025"

--80036_Sun_Dec_28_09_49_23_MST_2025
Content-Type: text/plain; charset=us-ascii

The third beta version of sudo 1.9.18 is now available.
Sudo 1.9.18 is a bug fix release.

Source:
    https://www.sudo.ws/dist/beta/sudo-1.9.18b3.tar.gz
    ftp://ftp.sudo.ws/pub/sudo/beta/sudo-1.9.18b3.tar.gz

SHA256 checksum:
    262e8fc43fea6938d1f7113df5cba99c2201d4e08a9f68e5344ada921d284d67

MD5 checksum:
    90be9e3ca26f1355180260e06924e98c

Binary packages:
    https://www.sudo.ws/getting/beta_packages/

For a list of download mirror sites, see:
    https://www.sudo.ws/getting/download_mirrors/

Sudo web site:
    https://www.sudo.ws/

Major changes between sudo 1.9.18b3 and 1.9.18b2:

 * Fixed a problem with AIX authentication when validating the
   password of Kerberos users not present in /etc/security/passwd.

 * Fixed a bug introduced in sudo 1.9.17 when running a command in
   background mode (sudo -b) in a pseudo-terminal.

Major changes between sudo 1.9.18b2 and 1.9.18b1:

 * New Persian (Farsi) translation of sudoers from translationproject.org.

 * Sudo now generates standard version 4 random UUIDs.  Previously
   the type and variant fields were stored in host byte order instead
   of network byte order.

 * Fixed a bug when formatting UUIDs as strings where the '-'
   characters were in the wrong positions.

 * The log ID sent to the client by sudo_logsrvd now includes a
   UUID to prevent ID guessing attacks.  The remaining portion of
   the ID is a path relative to the I/O log dir.  Previously, it
   was an absolute path.

 * Fixed a large number of potential problems found by the ZeroPath
   AI Security Engineer <https://zeropath.com>.

 * Fixed a bug in "sudo -i" where the SHELL variable was set twice
   in the environment.

 * In sudo_logsrvd.conf, the default value for listen_address now
   depends on whether or not TLS has been configured.  If any of the
   TLS options have been enabled, the default is now to enable the
   TLS listener.  Otherwise, the plaintext listener is enabled.
   Previously, the default was to use both a plaintext and TLS listener.

Major changes between sudo 1.9.18b1 and 1.9.17p2:

 * Updated the embedded copy of protobuf-c to version 1.5.2
   and regenerated code from the .proto files.

 * In intercept mode on Linux, the seccomp filter will now kill the
   process if the architecture does not match the native or compatible
   architectures.

 * Fixed a problem in sudoreplay where a speed factor of 0 or less
   would result in a negative delay value that caused a hang during
   playback. Bug #1078.

 * Restored the ability to run "sudo -u myname -g group" when the
   user portion of the Runas_Spec is non-empty and the specified
   group matches the Runas_Spec.  Reported by Marc Schoolderman of
   the sudo-rs project.

 * Fixed a bug with "sudo -U otheruser -l" where the NOPASSWD tag
   was being applied for commands other than "ALL" or "list".  The
   NOPASSWD tag should only be applied when listing another user's
   privileges if the command is "ALL" or "list".  Reported by Marc
   Schoolderman of the sudo-rs project.

 * The "-fcf-protection=full" compiler option is now only used for
   x86_64 CPUs.  For 32-bit x86 CPUs, "-fcf-protection=return" is
   used instead.  This fixes an illegal instruction problem on some
   older Intel-compatible CPUs that do not implement the ENDBR32
   instruction.

 * The sudo_sendlog man page is now only installed when sudo_sendlog
   itself is installed.  GitHub issue #467

 * Sudo now uses most of the suggested compiler and linker options
   from the OpenSSF Compiler Options Hardening Guide for C and C++.

 * Fixed multiple potential crashes in sudo_logsrvd.
   Found by Joshua Rogers (https://joshua.hu) using the ZeroPath
   tool (https://zeropath.com/).

 * Fixed a potential message corruption error in sudo_logsrvd.
   Found by Joshua Rogers (https://joshua.hu) using the ZeroPath
   tool (https://zeropath.com/).

 * Fixed multiple resource leaks on error paths.  Found by Joshua
   Rogers (https://joshua.hu) using the ZeroPath tool
   (https://zeropath.com/).

 * Fixed a potential path traversal bug in sudo_logsrvd when
   restarting an existing log file.  The log ID is used to
   construct the path to the log file and must not contain
   any ".." path components.  Found by Joshua Rogers
   (https://joshua.hu) using the ZeroPath tool (https://zeropath.com/).

 * Fixed a bug in sudo_sendlog that prevented it from transmitting
   older sudo I/O logs that lack a log.json file.

 * sudo_sendlog now verifies the server certificate by default,
   as per the documentation.

 * Fixed a bug that prevented the sending of exit events to the
   sudo log server when I/O logging is not enabled.

 * Fixed a bug that caused sudo-style logs generated by sudo_logsrvd
   to be line-wrapped after 5 characters.

 * When sudo_logsrvd verifies TLS client certificates, it now uses
   the IP address of the peer as well as the DNS hostname, if it
   can be resolved from the address.  Previously, sudo_logsrvd would
   resolve DNS hostnames in the client's certificate to IP addresses
   and compare them to the client IP address.

 * When sudo is logging to a remote log server (sudo_logsrvd),
   if the connection to the server is dropped, the socket is now
   closed immediately.  This fixes an issue when restarting
   sudo_logsrvd on some systems.

 * Fixed a bug that could result in sudo waiting 5 seconds after
   the command exits when logging events, but not I/O, to sudo_logsrvd.

--80036_Sun_Dec_28_09_49_23_MST_2025
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEWdHpzLorN2cE/dNbqfTAIc6kcPsFAmlRX5MACgkQqfTAIc6k
cPtb0w//SUCdX613IeZYFEcLWADoxOm/WWWLiI+wi7e0WhL7YYFuNLi+lRftAFXp
JUI9HQ/k7RJlICmy/BiRdFv8G66UdD0mNFENl+iQPtQFJqmAqBA5QETJrTVDPXEl
lMt7trc8W1DTbGt4F8K+RjhF22z3MoD6Z65s5XC2qzPDK8Kw7dYqN5CujIdm4IIu
6v9BGnaUlFZCxVs8x2MjE5pC5uGXJpxh6AR1ftbtJf9MxkydrdJkUnBBw57yQIVR
oqmytiB27VHHSOMwG8g5HiGzqADQQ5++v6eJrFd6Cmy1se63NBnAwSmTZhs3F3n1
2w87ZKRv275JqIQ5RAdCx8YpE5vD/At4F3c9BM2qXMz7CRFfWSvkjDwgrFq49IAR
WI3wd8ZJ/PYHGjQwcYls4Ysw3DkDb2QtLGlx0asSg2E2MYRI+m+Dnnynj6Fh0VYw
NK8jQX+hsDVKpOixy0Z0D3oiY2nI+PKO74ylfaemgyAz1HQ+l9g9VlKkTidDf53h
i0xcA19wg5Fk1XloqXVOam1L5ZsIxEnf3nnN1kJXpUHuv9Q47GVBPBQ9h2NKB/By
0+OZRt1sJHaIeqgps3Zyu7JZH20LfzvLIBSPyTnjv+RglCavp0sVsN+mYMz2SY4T
+llEtZ/ysmnpyurryXT6CXndyXmQISgXDrG/zRFZaGy/xva3Y2M=
=tVsn
-----END PGP SIGNATURE-----

--80036_Sun_Dec_28_09_49_23_MST_2025--


--===============1603515060459786346==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers

--===============1603515060459786346==--