CVE-2022-42717

Name
CVE-2022-42717
Description
An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423
MISC https://github.com/hashicorp/vagrant/pull/12910
MISC https://www.vagrantup.com/docs/synced-folders/nfs

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:hashicorp:packer:*:*:*:*:*:*:*:* packer >= None < 2.3.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
packer 3.16-community 1.8.1-r4 Galen Abell <galen@galenabell.com> possibly vulnerable
packer 3.17-community 1.8.4-r5 Galen Abell <galen@galenabell.com> possibly vulnerable
packer 3.18-community 1.8.7-r0 Galen Abell <galen@galenabell.com> possibly vulnerable
packer edge-community 1.9.1-r0 Galen Abell <galen@galenabell.com> possibly vulnerable