84 matches found
USN-8708-1 rust-sudo-rs vulnerability
It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only...
USN-8708-1: sudo-rs vulnerability
It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only...
PT-2026-90015
It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only...
FreeBSD : security/sudo-rs -- sudoedit could circumvent /etc/sudoers restrictions (c0acdbac-a524-11f1-8039-589cfc103809)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c0acdbac-a524-11f1-8039-589cfc103809 advisory. Trifecta Tech Foundation reports: Users that are explicitly permitted to edit only specific files using...
security/sudo-rs -- sudoedit could circumvent /etc/sudoers restrictions
Trifecta Tech Foundation reports: Users that are explicitly permitted to edit only specific files using sudoedit, are still able to place files in arbitrary directories. This only affects systems where sudoedit is used to give very fine-grained edit permissions, which is not the default...
Fedora: Security Advisory (FEDORA-2025-4388808bbf)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory (FEDORA-2025-a9d9780cbb)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory (FEDORA-2025-ada7909175)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 42 Update: sudo-rs-0.2.10-1.fc42
A memory safe implementation of sudo and su...
Fedora 41 : sudo-rs (2025-ada7909175)
The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ada7909175 advisory. Update to version 0.2.10. This release includes fixes for CVE-2025-64170 and CVE-2025-64517. Tenable has extracted the preceding description block...
Fedora 42 : sudo-rs (2025-4388808bbf)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4388808bbf advisory. Update to version 0.2.10. This release includes fixes for CVE-2025-64170 and CVE-2025-64517. Tenable has extracted the preceding description block...
Fedora 43 : sudo-rs (2025-a9d9780cbb)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a9d9780cbb advisory. Update to version 0.2.10. This release includes fixes for CVE-2025-64170 and CVE-2025-64517. Tenable has extracted the preceding description block...
FreeBSD : sudo-rs -- Partial password reveal when password timeout occurs (c1ceaaea-c2e7-11f0-8372-98b78501ef2a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c1ceaaea-c2e7-11f0-8372-98b78501ef2a advisory. Trifecta Tech Foundation reports: When typing partial passwords but not pressing return for a long time...
sudo-rs doesn't record authenticating user properly in timestamp
Summary When Defaults targetpw or Defaults rootpw is enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs prior to 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as user's UID in the...
GHSA-Q428-6V73-FC4Q sudo-rs doesn't record authenticating user properly in timestamp
Summary When Defaults targetpw or Defaults rootpw is enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs prior to 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as user's UID in the...
CVE-2025-64517
A flaw was found in sudo-rs. This vulnerability allows authentication bypass via incorrect recording of the authenticating user in the timestamp...
CVE-2025-64517
sudo-rs is a memory safe implementation of sudo and su written in Rust. With Defaults targetpw or Defaults rootpw enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10...
UBUNTU-CVE-2025-64517
sudo-rs is a memory safe implementation of sudo and su written in Rust. With Defaults targetpw or Defaults rootpw enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10...
CVE-2025-64517 sudo-rs doesn't record authenticating user properly in timestamp
sudo-rs is a memory safe implementation of sudo and su written in Rust. With Defaults targetpw or Defaults rootpw enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10...
CVE-2025-64517 sudo-rs doesn't record authenticating user properly in timestamp
sudo-rs is a memory safe implementation of sudo and su written in Rust. With Defaults targetpw or Defaults rootpw enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10...