diff --git a/sudo-1.9.12-CVE-2023-22809.patch b/sudo-1.9.12-CVE-2023-22809.patch
new file mode 100644
index 0000000..66f866f
--- /dev/null
+++ b/sudo-1.9.12-CVE-2023-22809.patch
@@ -0,0 +1,121 @@
+diff -up ./plugins/sudoers/editor.c.cve ./plugins/sudoers/editor.c
+--- ./plugins/sudoers/editor.c.cve	2021-01-09 21:12:16.000000000 +0100
++++ ./plugins/sudoers/editor.c	2023-01-17 13:57:05.598949058 +0100
+@@ -126,7 +126,7 @@ resolve_editor(const char *ed, size_t ed
+     const char *tmp, *cp, *ep = NULL;
+     const char *edend = ed + edlen;
+     struct stat user_editor_sb;
+-    int nargc;
++    int nargc = 0;
+     debug_decl(resolve_editor, SUDOERS_DEBUG_UTIL);
+ 
+     /*
+@@ -144,9 +144,7 @@ resolve_editor(const char *ed, size_t ed
+     /* If we can't find the editor in the user's PATH, give up. */
+     if (find_path(editor, &editor_path, &user_editor_sb, getenv("PATH"), NULL,
+ 	    0, allowlist) != FOUND) {
+-	free(editor);
+-	errno = ENOENT;
+-	debug_return_str(NULL);
++        goto bad;
+     }
+ 
+     /* Count rest of arguments and allocate editor argv. */
+@@ -166,6 +164,18 @@ resolve_editor(const char *ed, size_t ed
+ 	nargv[nargc] = copy_arg(cp, ep - cp);
+ 	if (nargv[nargc] == NULL)
+ 	    goto oom;
++
++	/*
++	 * We use "--" to separate the editor and arguments from the files
++	 * to edit.  The editor arguments themselves may not contain "--".
++	 */
++	if (strcmp(nargv[nargc], "--") == 0) {
++	    sudo_warnx(U_("ignoring editor: %.*s"), (int)edlen, ed);
++	    sudo_warnx("%s", U_("editor arguments may not contain \"--\""));
++	    errno = EINVAL;
++	    goto bad;
++	}
++
+     }
+     if (nfiles != 0) {
+ 	nargv[nargc++] = "--";
+@@ -179,6 +189,7 @@ resolve_editor(const char *ed, size_t ed
+     debug_return_str(editor_path);
+ oom:
+     sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
++bad:
+     free(editor);
+     free(editor_path);
+     if (nargv != NULL) {
+diff -up ./plugins/sudoers/sudoers.c.cve ./plugins/sudoers/sudoers.c
+--- ./plugins/sudoers/sudoers.c.cve	2023-01-17 13:50:33.718255775 +0100
++++ ./plugins/sudoers/sudoers.c	2023-01-17 14:00:53.049710094 +0100
+@@ -724,21 +724,34 @@ sudoers_policy_main(int argc, char * con
+ 
+     /* Note: must call audit before uid change. */
+     if (ISSET(sudo_mode, MODE_EDIT)) {
++    const char *env_editor = NULL;
+ 	char **edit_argv;
+ 	int edit_argc;
+-	const char *env_editor;
++
+ 
+ 	free(safe_cmnd);
+ 	safe_cmnd = find_editor(NewArgc - 1, NewArgv + 1, &edit_argc,
+ 	    &edit_argv, NULL, &env_editor, false);
+ 	if (safe_cmnd == NULL) {
+-	    if (errno != ENOENT)
+-		goto done;
+-	    audit_failure(NewArgv, N_("%s: command not found"),
+-		env_editor ? env_editor : def_editor);
+-	    sudo_warnx(U_("%s: command not found"),
+-		env_editor ? env_editor : def_editor);
+-	    goto bad;
++
++	    switch (errno) {
++	    case ENOENT:
++		audit_failure(NewArgv, N_("%s: command not found"),
++		    env_editor ? env_editor : def_editor);
++		sudo_warnx(U_("%s: command not found"),
++		    env_editor ? env_editor : def_editor);
++		goto bad;
++	    case EINVAL:
++		if (def_env_editor && env_editor != NULL) {
++		    /* User tried to do something funny with the editor. */
++		    log_warningx(SLOG_NO_STDERR|SLOG_AUDIT|SLOG_SEND_MAIL,
++			"invalid user-specified editor: %s", env_editor);
++		    goto bad;
++		}
++		FALLTHROUGH;
++	    default:
++            goto done;
++        }
+ 	}
+ 	sudoers_gc_add(GC_VECTOR, edit_argv);
+ 	NewArgv = edit_argv;
+diff -up ./plugins/sudoers/visudo.c.cve ./plugins/sudoers/visudo.c
+--- ./plugins/sudoers/visudo.c.cve	2021-01-09 21:12:16.000000000 +0100
++++ ./plugins/sudoers/visudo.c	2023-01-17 14:02:01.393135129 +0100
+@@ -303,7 +303,7 @@ static char *
+ get_editor(int *editor_argc, char ***editor_argv)
+ {
+     char *editor_path = NULL, **allowlist = NULL;
+-    const char *env_editor;
++    const char *env_editor = NULL;
+     static char *files[] = { "+1", "sudoers" };
+     unsigned int allowlist_len = 0;
+     debug_decl(get_editor, SUDOERS_DEBUG_UTIL);
+@@ -337,7 +337,11 @@ get_editor(int *editor_argc, char ***edi
+     if (editor_path == NULL) {
+ 	if (def_env_editor && env_editor != NULL) {
+ 	    /* We are honoring $EDITOR so this is a fatal error. */
+-	    sudo_fatalx(U_("specified editor (%s) doesn't exist"), env_editor);
++	    if (errno == ENOENT) {
++		sudo_warnx(U_("specified editor (%s) doesn't exist"),
++		    env_editor);
++	    }
++	    exit(EXIT_FAILURE);
+ 	}
+ 	sudo_fatalx(U_("no editor found (editor path = %s)"), def_editor);
+     }
diff --git a/sudo.spec b/sudo.spec
index dd3a228..8c29268 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.5p2
-Release: 8%{?dist}
+Release: 9%{?dist}
 License: ISC
 URL: https://www.sudo.ws
 
@@ -32,6 +32,7 @@ Patch4: sudo-1.9.5-sesh-bad-condition.patch
 Patch5: sudo-1.9.5-utmp-leak.patch
 Patch6: covscan.patch
 Patch7: sha-digest-calc.patch
+Patch8: sudo-1.9.12-CVE-2023-22809.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -71,6 +72,7 @@ BuildRequires:  python3-devel
 %patch5 -p1 -b .utmp-leak
 %patch6 -p1 -b .covscan
 %patch7 -p1 -b .sha-digest
+%patch8 -p1 -b .cve-fix
 
 %build
 # Remove bundled copy of zlib
@@ -245,6 +247,11 @@ EOF
 %attr(0644,root,root) %{_libexecdir}/sudo/python_plugin.so
 
 %changelog
+* Thu Jan 19 2023 Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-9
+RHEL 9.2.0 ERRATUM
+- CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
+Resolves: rhbz#2161225
+
 * Wed Jan 11 2023 Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-8
 RHEL 9.2.0 ERRATUM
 - sudo digest check fails incorrectly for certain file sizes (SHA512/SHA384)