CVE-2023-7090

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	sudo	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Fedora	Fedora	—
Fedora	Fedora	—

References

https://access.redhat.com/security/cve/CVE-2023-7090Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2255723Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html
https://security.netapp.com/advisory/ntap-20240208-0001/
https://www.sudo.ws/releases/legacy/#1.8.28Release Notes
https://access.redhat.com/security/cve/CVE-2023-7090Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2255723Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html
https://security.netapp.com/advisory/ntap-20240208-0001/
https://www.sudo.ws/releases/legacy/#1.8.28Release Notes

Timeline

Published: Dec 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-70918.8A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /up CVE-2023-70924.3A vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /CVE-2023-70937.8A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown functi CVE-2023-70947.5A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is CVE-2023-70959.8A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the fu CVE-2023-70969.8A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/cru CVE-2023-70979.8A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /a CVE-2023-70985.3** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects un CVE-2023-70999.8A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affect CVE-2023-71009.8A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown funct CVE-2023-71017.8Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary co CVE-2023-71029.8Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.T