CVE-2022-42717: High severity HashiCorp Vagrant vulnerability
An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hashicorp/packerto a version that resolves this vulnerability.Fixed in 2.3.1 - Compensating control
On Linux, replace the recommended (insecure) sudoers configuration for Vagrant with a secure sudoers configuration that does not allow wildcard expansion that non-privileged users can leverage to execute arbitrary commands as root.
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-42717.
What is the severity level of CVE-2022-42717?
The severity level of CVE-2022-42717 is high (7.8).
What is the affected software?
The affected software is Hashicorp Vagrant before version 2.3.1.
How can non-privileged users leverage the vulnerability?
Non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands.
How can I fix the vulnerability?
To fix the vulnerability, upgrade to Hashicorp Vagrant version 2.3.1 or higher.